Cribl Data Routing & Processing 3 — Questions and Answers
Question 1: In Cribl Stream, what is the role of a 'Lookup' function within a pipeline?
- Queries an external database in real time
- Enriches events using a static or dynamic lookup table (Correct answer)
- Routes events based on geographic location
- Validates field values against a schema
Correct answer: Enriches events using a static or dynamic lookup table
The Lookup function enriches events by matching a field value against a CSV or Redis-backed lookup table and appending additional fields.
Question 2: Which Cribl Stream feature lets you selectively replay archived data from an S3 bucket back into your pipelines?
- Data Replay (Correct answer)
- Source Rehydration
- Collector
- Backfill
Correct answer: Data Replay
Data Replay allows you to send previously archived data stored in S3 back through Cribl Stream pipelines for reprocessing or analysis.
Question 3: What is the primary use of the 'Eval' function in Cribl Stream?
- Evaluating route filter expressions
- Adding, modifying, or deleting fields using JavaScript expressions (Correct answer)
- Validating JSON schema compliance
- Running external scripts on events
Correct answer: Adding, modifying, or deleting fields using JavaScript expressions
The Eval function lets you manipulate event fields using JavaScript expressions, making it one of the most versatile pipeline functions.
Question 4: In Cribl Stream, which load balancing strategy distributes events evenly across all workers in a worker group?
- Sticky routing
- Round-robin (Correct answer)
- Priority queue
- Least connections
Correct answer: Round-robin
Round-robin load balancing distributes events sequentially across all available workers, ensuring even load distribution.
Question 5: Which Cribl Stream pipeline function would you use to parse a raw syslog message into structured fields?
- Regex Extract
- Syslog Parser (Correct answer)
- JSON Unroll
- CSV Parser
Correct answer: Syslog Parser
The Syslog Parser function parses RFC 3164 or RFC 5424 syslog messages into structured fields like facility, severity, hostname, and message.
Question 6: What does the 'Mask' function in Cribl Stream do?
- Hides events from certain destinations
- Obfuscates or redacts sensitive field values using patterns (Correct answer)
- Encrypts the entire event payload
- Removes all fields except specified ones
Correct answer: Obfuscates or redacts sensitive field values using patterns
The Mask function replaces sensitive data such as PII or credentials with redacted values using regex-based pattern matching.
Question 7: In Cribl Stream routing, what does a filter expression of 'true' on a route accomplish?
- Disables the route
- Matches all events unconditionally (Correct answer)
- Sends events only during business hours
- Routes only events with errors
Correct answer: Matches all events unconditionally
A filter expression of 'true' matches every event, making the route act as a catch-all that processes all events passing through.
Cribl Data Routing & Processing 3
In Cribl Stream, what is the role of a 'Lookup' function within a pipeline?