Cribl Architecture & Components 3 — Questions and Answers
Question 1: In Cribl Stream, what is the correct sequence of data flow through the system?
- Pipeline → Route → Source → Destination
- Source → Route → Pipeline → Destination (Correct answer)
- Route → Source → Destination → Pipeline
- Source → Pipeline → Route → Destination
Correct answer: Source → Route → Pipeline → Destination
Data enters through a Source, is matched by a Route to a Pipeline for transformation, and then forwarded to a Destination.
Question 2: What does setting the 'Final' flag on a Route in Cribl Stream accomplish?
- It permanently deletes events matching the route filter
- It archives matched events to Cribl Lake before forwarding them
- It marks the route as read-only to prevent accidental edits
- It prevents matched events from being evaluated by any subsequent routes (Correct answer)
Correct answer: It prevents matched events from being evaluated by any subsequent routes
The Final flag stops route evaluation for matching events, ensuring they are only processed by the designated pipeline and not re-matched by later routes.
Question 3: Which Cribl Stream pipeline function is specifically designed to mask or redact sensitive data such as credit card numbers or SSNs?
- Mask (Correct answer)
- Drop
- Serialize
- Flatten
Correct answer: Mask
The Mask function applies regex-based redaction or hashing to specific fields, protecting sensitive PII data as it flows through the pipeline.
Question 4: What is the purpose of the 'Eval' function in a Cribl Stream pipeline?
- To evaluate whether an event matches a route filter condition
- To drop events that fail a validation check
- To add, modify, or remove event fields using JavaScript expressions (Correct answer)
- To parse structured formats like JSON or CSV into individual fields
Correct answer: To add, modify, or remove event fields using JavaScript expressions
Eval allows users to write JavaScript expressions to dynamically compute new fields, transform existing field values, or remove fields from events.
Question 5: In a Cribl Stream pipeline, what does 'cloning' an event enable?
- Creating a backup copy stored in Cribl Lake automatically
- Producing multiple copies of an event that can be routed to different destinations (Correct answer)
- Duplicating the pipeline configuration to another Worker Group
- Reprocessing an event through the same pipeline a second time for validation
Correct answer: Producing multiple copies of an event that can be routed to different destinations
Cloning creates additional copies of an event within the pipeline, enabling fan-out so one event can reach multiple destinations with potentially different transformations.
Question 6: What type of Cribl Stream Source would you configure to receive data pushed directly from Splunk Universal Forwarders?
- HTTP Event Collector (HEC)
- Syslog UDP
- Kafka Consumer
- Splunk TCP (S2S) (Correct answer)
Correct answer: Splunk TCP (S2S)
The Splunk TCP (S2S) source speaks the Splunk-to-Splunk protocol, allowing Cribl to act as a drop-in replacement for a Splunk indexer or heavy forwarder.
Question 7: What is the function of a 'Lookup' table in a Cribl Stream pipeline?
- Enriching events by matching a field value against an external reference table to add contextual fields (Correct answer)
- Searching the Cribl Leader node for configuration metadata by key
- Locating archived events stored in Cribl Lake by a specific field value
- Mapping route filter expressions to human-readable descriptions in the UI
Correct answer: Enriching events by matching a field value against an external reference table to add contextual fields
Lookup tables allow pipeline functions to join event data with external CSV or JSON reference files, adding contextual fields like asset names or user department.
Cribl Architecture & Components 3
In Cribl Stream, what is the correct sequence of data flow through the system?