General Discussions

Discussion List

• 
  Is setting up Cribl WEC/WEF the same that is used in Windows Events routed to a WEC server?

  Answered Franky Laarits 4.2K views 4 comments 0 points Most recent by Anson VanDoren September 2023
• 
  What is the best way to remove a JSON array from _raw JSON data and reserialize to _raw?

  Answered Shawn Cannon 7K views 14 comments 0 points Most recent by David Maislin September 2023
• 
  Is there any checkpoint mechanism in REST collector?

  Answered Chris Rogers 1K views 1 comment 0 points Most recent by David Maislin September 2023
• 
  Any idea how I can add a field with its value to an existing field?

  Answered Johan Woger 2.7K views 3 comments 0 points Most recent by David Maislin September 2023
• 
  Curious if anyone has a way to show splunk license utilization and cribl savings on the same chart?

  Answered Franky Laarits 7.6K views 7 comments 0 points Most recent by Franky Laarits September 2023
• 
  Can we limit the number of lines per event instead of the max bytes?

  Answered Joshua Napier 2.9K views 3 comments 0 points Most recent by xpac xpac September 2023
• 
  Is anyone aware of why the leader needs to restart in order for auth changes?

  Answered Gayathri Pandyaram 2.4K views 2 comments 0 points Most recent by dritan September 2023
• 
  Anyone know where the the Auth logs for Cribl Stream/Edge are located?

  Answered ✓ Gayathri Pandyaram 8.4K views 12 comments 0 points Most recent by Brandon McCombs September 2023
• 
  Data Enrichment on the fly using cribl stream with the enrichments are from a CSV lookup

  Answered Mina Yacoub 2.6K views 2 comments 0 points Most recent by Paul Hoffman September 2023
• 
  Getting Cribl to see the added data at the bottom of a CSV file

  Answered Jon Rust 11.1K views 15 comments 0 points Most recent by Jon Rust September 2023
• 
  Is there a way to use the API to `PATCH` a lookup table in a pack?

  Answered ✓ JP Bourget 12.7K views 15 comments 0 points Most recent by Eric Fontenot September 2023
• 
  I have a problem with some of the data coming into Cribl from Splunk

  Answered Jon Rust 10.8K views 16 comments 0 points Most recent by David Maislin September 2023
• 
  Is there a way to extract the key-value pair in the JSON object from the _raw field in the Pipeline?

  Answered alan y 6.7K views 13 comments 0 points Most recent by xpac xpac September 2023
• 
  With the Scripted Collector, how can I tell if it is a Preview, Discovery, Full Run, or Scheduled?

  Answered Quinn Stevenson 6.7K views 9 comments 0 points Most recent by Quinn Stevenson September 2023
• 
  Moved: What would be the pros/cons of putting an edge client on their syslog server

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 2023
• 
  Data be passed to the Redis function to then write the results into Redis?

  Answered Shawn Cannon 6.7K views 14 comments 0 points Most recent by Raanan Dagan September 2023
• 
  Moved: Deploying edge node on K8 but the edge node is not visible on our Leader

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 2023
• 
  How does the primary server schedule out script collectors?

  Answered Shawn Cannon 4.8K views 10 comments 0 points Most recent by Shawn Cannon September 2023
• 
  Is there a way to see what event breaker rules are being used?

  Answered Shawn Cannon 4.4K views 4 comments 0 points Most recent by Ryan Hennessy September 2023
• 
  which rate a cribl2cribl connection via tcp can be compressed?

  Answered Rob Franz 2.2K views 3 comments 0 points Most recent by Brendan Dalpe September 2023
• 
  Is there an easy way to transfer the leader node to a new box?

  Answered Jordan Perks 4.9K views 8 comments 0 points Most recent by Raanan Dagan September 2023
• 
  Am I able to search for the key value pairs found under _raw in a query?

  Answered ✓ Justin Hamblin 7.4K views 10 comments 0 points Most recent by Brandon McCombs September 2023
• 
  I am needing to modify a default filter in a pack,

  Answered Mick Shanaghy 3.3K views 6 comments 0 points Most recent by Raanan Dagan September 2023
• 
  Which source/destination combo is advised and provides the best compression?

  Answered John Pondrom 5.8K views 5 comments 0 points Most recent by David Maislin September 2023
• 
  Is there a Cribl.cloud specific documentation?

  Answered Taylor Mill 5.3K views 8 comments 0 points Most recent by Taylor Mill September 2023
• 
  I'm having a hard time get Redis running on my Cribl Workers

  Answered Rob Franz 24.3K views 43 comments 0 points Most recent by xpac xpac September 2023
• 
  Is there a way to check historical data volume for a Source?

  Answered alan y 1.8K views 2 comments 0 points Most recent by alan y September 2023
• 
  Question on renaming a field in a json event

  Answered jlstanley 4.5K views 7 comments 0 points Most recent by jlstanley September 2023
• 
  When I have notification with default target, Does this get recorded in Cribl logs?

  Answered Martin Prado 6.6K views 9 comments 0 points Most recent by Martin Prado September 2023
• 
  Anyone have a list of prefixes that are used for Source / Destination objects?

  Answered Brandon McCombs 3.7K views 6 comments 0 points Most recent by Brandon McCombs September 2023