Cribl Architecture & Components 4

Question 1

Which Cribl Stream destination type would you use to send processed events to Splunk's HTTP Event Collector?

Accepted Answer

Splunk HEC

Answer

The Splunk HEC destination sends events over HTTPS to Splunk's HTTP Event Collector endpoint, the preferred method for Splunk Cloud and on-premises HEC ingestion.

Question 2

What is Cribl Edge primarily designed to accomplish?

Accepted Answer

Collecting and pre-processing observability data at or near the source before forwarding to a central pipeline

Answer

Cribl Edge is a lightweight agent deployed close to data sources — servers, containers, endpoints — to collect, filter, and reduce telemetry before it reaches the central pipeline.

Question 3

In Cribl Stream, which output format writes data to object storage (e.g., Amazon S3) in a columnar, compressed layout optimized for analytics?

Accepted Answer

Parquet

Answer

Parquet is a columnar, compressed file format ideal for analytical platforms like Athena, Snowflake, and BigQuery when writing to object stores like S3.

Question 4

What does configuring 'Load Balancing' across multiple destination endpoints in Cribl Stream accomplish?

Accepted Answer

It distributes outgoing events across multiple destination endpoints to increase throughput and resilience

Answer

When multiple endpoints are configured for a destination, Cribl round-robins or uses other strategies to distribute events, improving throughput and fault tolerance.

Question 5

Which protocol does the Cribl Stream 'Syslog' source use to receive events from network devices and servers?

Accepted Answer

UDP and/or TCP on configurable ports, commonly port 514

Answer

Syslog sources in Cribl accept both UDP and TCP connections, typically on port 514, which is the standard syslog port used by network devices and Linux servers.

(Cribl) Cribl Observability Pipeline Certification Practice Test

(Cribl) Cribl Observability Pipeline Certification Practice Test

Cribl Architecture & Components 4