We have updated our Terms of Service, Code of Conduct, and Addendum.

if I'm looking to forward the cribl metrics into splunk, is it similar to log data?

Options

I haven't done a ton with Splunk metric indexes in the past, if I'm looking to forward the cribl metrics into splunk, is it similar to log data, where I add an index field via a pipeline to route correctly so I can route the data into Splunk via HEC?

Answers

  • Jon Rust
    Jon Rust Posts: 431 mod
    Options

    yep. you could also depend on Splunk-side configs to override/provide a default index

  • etc_cribl
    etc_cribl Posts: 14 mod
    Options

    true, I didn't think of that as I just use a single HEC token at the moment for all my my Cribl needs

  • etc_cribl
    etc_cribl Posts: 14 mod
    Options

    thanks!

  • Paul Dott
    Paul Dott Posts: 31 ✭✭
    Options

    Curious, any advantages, of sending to the hec versus directly to the indexers?

  • Paul Dott
    Paul Dott Posts: 31 ✭✭
    Options

    For metrics especially.

  • Jon Rust
    Jon Rust Posts: 431 mod
    Options

    as in, you have a separate HF tier for HEC?

  • Jon Rust
    Jon Rust Posts: 431 mod
    Options

    or you mean HEC on the indexers vs S2S on the indexers?

  • etc_cribl
    etc_cribl Posts: 14 mod
    Options

    Not that it matters, but I'm a Splunk cloud customer, and I just generally send everything in via HEC

  • Jon Rust
    Jon Rust Posts: 431 mod
    Options

    I prefer: sources ---> Cribl ---hec---> indexers

  • Jon Rust
    Jon Rust Posts: 431 mod
    Options

    not a fan of: sources ---> Cribl ---hec---> HF ---S2S--> indexers

  • etc_cribl
    etc_cribl Posts: 14 mod
    Options

    I don't have a Splunk HF tier at the moment, so I sort of view Cribl as my HF tier

  • Jon Rust
    Jon Rust Posts: 431 mod
    Options

    :chef_fingers_kiss:

  • Paul Dott
    Paul Dott Posts: 31 ✭✭
    Options

    Ah :cloud: gotcha. We do have a HEC HF tier. But for sources that don't need any TA's/additional data wrangling after Cribl, then it seems redundant to pass them through the HEC's, right? So for the internal metrics and log sources specifically: Source (internal metrics) --> Cribl (obvs) --> Splunk Indexer LB

  • Jon Rust
    Jon Rust Posts: 431 mod
    Options

    you can do it that way. I prefer delivery to HEC on indexers (not HFs). I like HEC delivery over S2S