Source & Destination Configuration Flashcards

Which destination is used for sending data to Splunk?

Answer: Splunk HEC

Splunk HEC (HTTP Event Collector) is a common and efficient method for sending data to Splunk indexers. Cribl provides a dedicated Splunk HEC destination type, allowing it to seamlessly forward processed observability data to Splunk for indexing, storage, and subsequent analysis.

Which source ingests files from a directory?

Answer: File Monitor

The `File Monitor` input in Cribl is designed to ingest log data from files residing in specified directories on the file system. It continuously monitors these files for new entries, allowing Cribl to collect both historical and real-time log data from local or mounted storage locations.

What is required when setting up a destination?

Answer: Hostname, port, protocol

When configuring a destination in Cribl, essential network details are required to establish connectivity with the target system. This typically includes the hostname or IP address of the destination, the specific port it listens on, and the communication protocol (e.g., TCP, UDP, HTTP) to be used for data transmission.

Which cloud storage can Cribl output to?

Answer: Amazon S3

Cribl supports outputting processed data to various cloud storage services for archiving or further analysis. Amazon S3 (Simple Storage Service) is a widely used and supported destination, allowing users to store large volumes of data securely and cost-effectively in the AWS cloud.

Which source captures log data from network ports?

Answer: TCP/UDP

The `TCP/UDP` input in Cribl is specifically designed to capture log data that is sent over network ports using either the TCP or UDP protocols. This allows Cribl to act as a listener for various network-based log sources, such as Syslog, NetFlow, or custom application streams, enabling real-time ingestion.

What is a best practice when configuring inputs?

Answer: Use filters to limit ingestion

A best practice when configuring inputs is to apply filters as early as possible to limit the amount of data ingested into the pipeline. This reduces unnecessary processing, saves compute resources, and ensures that only relevant data enters the observability pipeline, improving overall efficiency and reducing costs.

Which destination can forward to an indexer?

Answer: Indexer (Splunk/Elastic)

An indexer, such as those found in Splunk or Elasticsearch, is a primary destination for processed observability data. Cribl's role is often to prepare, enrich, and optimize data before forwarding it to these indexers, where it is stored, indexed, and made searchable for analysis by users.

Which input supports JSON data?

Answer: HTTP Collector

The `HTTP Collector` input in Cribl is designed to receive data via HTTP POST requests, making it ideal for ingesting structured data formats like JSON. Many applications and services can send JSON payloads directly to an HTTP endpoint, which Cribl can then efficiently process within its pipelines.

What is a stream in Cribl?

Answer: Logical data flow definition

In Cribl, a stream represents a logical definition of how data flows through the system. It defines the sequence of pipelines and functions that data will traverse from its source to its destination. This allows for flexible and organized processing of observability data.