Data Transformation & Enrichment Flashcards

Which Cribl function is used to add, update, or delete event fields using JavaScript expressions?

Answer: Eval

The Eval function evaluates JavaScript expressions to create, update, or remove fields from events as they flow through a pipeline.

In Cribl Stream, the GeoIP function enriches events with geolocation data based on which field type?

Answer: IP address

The GeoIP function looks up geolocation metadata (country, city, latitude/longitude) using an IP address field present in the event.

What does the Drop function do in a Cribl pipeline?

Answer: Removes entire events from the pipeline

The Drop function completely removes matching events from the pipeline, preventing them from reaching any downstream destination.

Which Cribl function is used to extract fields from raw text using named capture groups in regular expressions?

Answer: Regex Extract

The Regex Extract function applies a regular expression with named capture groups to a source field and promotes the captured values as new event fields.

The Lookup function in Cribl Stream uses which type of file to enrich events with additional data?

Answer: CSV files

Cribl's Lookup function uses CSV files (uploaded as Knowledge Objects) to match event field values and append additional columns to enriched events.

What is the primary purpose of the Sample function in a Cribl Stream pipeline?

Answer: To reduce event volume by keeping only a subset of matching events

The Sample function reduces data volume by allowing only 1 out of every N matching events to pass through, discarding the rest.

Which Cribl function parses a JSON string stored in a single field and promotes its keys as top-level event fields?

Answer: JSON Unpack

JSON Unpack extracts the key-value pairs from a JSON-encoded string field and flattens them into individual top-level fields on the event.