Cribl Data Routing & Processing 2 — Questions and Answers
Question 1: In Cribl Stream, which component is responsible for determining which pipeline processes an event?
- Source
- Route (Correct answer)
- Destination
- Pack
Correct answer: Route
Routes evaluate filter expressions against incoming events to determine which pipeline should process each event.
Question 2: What happens to an event in Cribl Stream when no route's filter expression matches it?
- It is automatically dropped
- It passes through to the default route (Correct answer)
- It is sent to all destinations
- It generates an error
Correct answer: It passes through to the default route
Events that match no other route fall through to the default route, which typically passes events unchanged.
Question 3: Which Cribl Stream function allows you to send a copy of an event to an alternate pipeline without removing it from the current flow?
- Clone (Correct answer)
- Publish Metrics
- Dynamic Router
- Eval
Correct answer: Clone
The Clone function duplicates an event so one copy continues through the current pipeline while another is sent elsewhere.
Question 4: What is the purpose of the 'Final' flag on a Cribl Stream route?
- It marks the last destination in a pipeline
- It stops further route evaluation once the route matches (Correct answer)
- It triggers immediate delivery without buffering
- It signals end-of-stream to the destination
Correct answer: It stops further route evaluation once the route matches
When a route is marked Final, no subsequent routes are evaluated if that route's filter matches the event.
Question 5: In a Cribl Stream pipeline, the Suppress function is used to:
- Remove fields from events
- Deduplicate or throttle repetitive events (Correct answer)
- Route events to a null destination
- Convert events to metrics
Correct answer: Deduplicate or throttle repetitive events
Suppress reduces noise by dropping duplicate or high-frequency events based on configurable key fields and time windows.
Question 6: Which Cribl Stream destination type is best suited for long-term cold storage at the lowest cost?
- Splunk HEC
- S3-Compatible Object Store (Correct answer)
- Elastic
- Syslog
Correct answer: S3-Compatible Object Store
S3-compatible object stores like AWS S3 offer the lowest cost per GB for long-term archival of observability data.
Question 7: What does the 'Passthru' pipeline in Cribl Stream do?
- Drops all events
- Passes events to all routes simultaneously
- Forwards events without any transformation (Correct answer)
- Converts events to metrics
Correct answer: Forwards events without any transformation
The Passthru pipeline applies no functions to events, forwarding them to their destination exactly as received.
Cribl Data Routing & Processing 2
In Cribl Stream, which component is responsible for determining which pipeline processes an event?