General Discussions

Discussion List

• 
  Has anyone had to backpressure a destination via Persistent Queue?

  Answered Kyle McCririe 227 views 4 comments 0 points Most recent by Clint Sharp September 22
• 
  Does anyone have any instructions on how to update SSL certs using CLI?

  Answered Christopher Owen 1.3K views 20 comments 0 points Most recent by Raanan Dagan September 22
• 
  Moved: Is there a way we can add our own edge node info?

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 22
• 
  Is it possible in worker mappings to filter by CIDR, like conn_ip is in 10.0.0.0/24?

  Answered Megan Davis 219 views 4 comments 0 points Most recent by Jon Rust September 22
• 
  is it recommended to do a json extract after the GeoIP function?

  Answered Josh Brunvoll 225 views 5 comments 0 points Most recent by Jon Rust September 22
• 
  How can I have script collector to run every 30 seconds?

  Answered Martin Prado 388 views 6 comments 0 points Most recent by Jon Rust September 22
• 
  Is setting up Cribl WEC/WEF the same that is used in Windows Events routed to a WEC server?

  Answered Franky Laarits 282 views 4 comments 0 points Most recent by Anson VanDoren September 22
• 
  What is the best way to remove a JSON array from _raw JSON data and reserialize to _raw?

  Answered Shawn Cannon 534 views 14 comments 0 points Most recent by David Maislin September 22
• 
  Is there any checkpoint mechanism in REST collector?

  Answered Chris Rogers 71 views 1 comment 0 points Most recent by David Maislin September 22
• 
  Any idea how I can add a field with its value to an existing field?

  Answered Johan Woger 197 views 3 comments 0 points Most recent by David Maislin September 22
• 
  Curious if anyone has a way to show splunk license utilization and cribl savings on the same chart?

  Answered Franky Laarits 606 views 7 comments 0 points Most recent by Franky Laarits September 22
• 
  Can we limit the number of lines per event instead of the max bytes?

  Answered Joshua Napier 232 views 3 comments 0 points Most recent by xpac xpac September 22
• 
  Is anyone aware of why the leader needs to restart in order for auth changes?

  Answered Gayathri Pandyaram 186 views 2 comments 0 points Most recent by dritan September 22
• 
  Is there any way I can automate refreshing the access tokens in Cribl?

  Answered tpeveler 324 views 4 comments 0 points Most recent by Kevin Morris September 22
• 
  Anyone know where the the Auth logs for Cribl Stream/Edge are located?

  Answered ✓ Gayathri Pandyaram 1.1K views 12 comments 0 points Most recent by Brandon McCombs September 22
• 
  Data Enrichment on the fly using cribl stream with the enrichments are from a CSV lookup

  Answered Mina Yacoub 167 views 2 comments 0 points Most recent by Paul Hoffman September 22
• 
  Getting Cribl to see the added data at the bottom of a CSV file

  Answered Jon Rust 656 views 15 comments 0 points Most recent by Jon Rust September 22
• 
  Is there a way to use the API to `PATCH` a lookup table in a pack?

  Answered ✓ JP Bourget 1.2K views 15 comments 0 points Most recent by Eric Fontenot September 22
• 
  I have a problem with some of the data coming into Cribl from Splunk

  Answered Jon Rust 647 views 16 comments 0 points Most recent by David Maislin September 22
• 
  Is there a way to extract the key-value pair in the JSON object from the _raw field in the Pipeline?

  Answered alan y 507 views 13 comments 0 points Most recent by xpac xpac September 22
• 
  With the Scripted Collector, how can I tell if it is a Preview, Discovery, Full Run, or Scheduled?

  Answered Quinn Stevenson 516 views 9 comments 0 points Most recent by Quinn Stevenson September 22
• 
  Moved: What would be the pros/cons of putting an edge client on their syslog server

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 22
• 
  Data be passed to the Redis function to then write the results into Redis?

  Answered Shawn Cannon 587 views 14 comments 0 points Most recent by Raanan Dagan September 22
• 
  Moved: Deploying edge node on K8 but the edge node is not visible on our Leader

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 22
• 
  How does the primary server schedule out script collectors?

  Answered Shawn Cannon 363 views 10 comments 0 points Most recent by Shawn Cannon September 22
• 
  Is there a way to see what event breaker rules are being used?

  Answered Shawn Cannon 360 views 4 comments 0 points Most recent by Ryan Hennessy September 22
• 
  which rate a cribl2cribl connection via tcp can be compressed?

  Answered Rob Franz 165 views 3 comments 0 points Most recent by Brendan Dalpe September 22
• 
  Is there an easy way to transfer the leader node to a new box?

  Answered Jordan Perks 358 views 8 comments 0 points Most recent by Raanan Dagan September 22
• 
  Is there a way to move a worker to another group via GUI?

  Answered Jeremiah Ross 350 views 5 comments 0 points Most recent by Mugdha Khandekar September 22
• 
  Am I able to search for the key value pairs found under _raw in a query?

  Answered ✓ Justin Hamblin 439 views 10 comments 0 points Most recent by Brandon McCombs September 22