Cribl Data Routing & Processing 2

Question 1

In Cribl Stream, which component is responsible for determining which pipeline processes an event?

Accepted Answer

Route

Answer

Routes evaluate filter expressions against incoming events to determine which pipeline should process each event.

Question 2

What happens to an event in Cribl Stream when no route's filter expression matches it?

Accepted Answer

It passes through to the default route

Answer

Events that match no other route fall through to the default route, which typically passes events unchanged.

Question 3

Which Cribl Stream function allows you to send a copy of an event to an alternate pipeline without removing it from the current flow?

Accepted Answer

Clone

Answer

The Clone function duplicates an event so one copy continues through the current pipeline while another is sent elsewhere.

Question 4

What is the purpose of the 'Final' flag on a Cribl Stream route?

Accepted Answer

It stops further route evaluation once the route matches

Answer

When a route is marked Final, no subsequent routes are evaluated if that route's filter matches the event.

Question 5

In a Cribl Stream pipeline, the Suppress function is used to:

Accepted Answer

Deduplicate or throttle repetitive events

Answer

Suppress reduces noise by dropping duplicate or high-frequency events based on configurable key fields and time windows.

(Cribl) Cribl Observability Pipeline Certification Practice Test