Cribl Data Routing & Processing 4 — Questions and Answers
Question 1: Which Cribl Stream function converts individual events into multiple separate events?
- JSON Unroll
- Unroll (Correct answer)
- Event Breaker
- Serialize
Correct answer: Unroll
The Unroll function expands a JSON array field into individual events, one per array element.
Question 2: What is the purpose of the 'Serialize' function in Cribl Stream?
- Converts events to binary format for compression
- Converts structured fields into a serialized format like JSON, CSV, or key=value (Correct answer)
- Writes events to disk temporarily
- Orders events by timestamp
Correct answer: Converts structured fields into a serialized format like JSON, CSV, or key=value
Serialize converts event fields into a formatted string representation such as JSON, CSV, or key=value pairs in the _raw field.
Question 3: In Cribl Stream, a 'Dead Letter Queue' is used to:
- Store events that failed authentication
- Capture events that failed to be delivered to their destination (Correct answer)
- Archive events older than 90 days
- Hold events awaiting manual review
Correct answer: Capture events that failed to be delivered to their destination
The Dead Letter Queue captures events that could not be delivered to a destination, allowing inspection and reprocessing without data loss.
Question 4: Which configuration in Cribl Stream controls the maximum number of events buffered before a destination drops data during backpressure?
- Throttle limit
- Persistent Queue size (Correct answer)
- Output batch size
- Worker concurrency
Correct answer: Persistent Queue size
The Persistent Queue size setting determines how much data can be queued on disk before backpressure causes data loss at a destination.
Question 5: What is the function of the 'Dynamic Router' in Cribl Stream pipelines?
- Automatically scales worker count based on throughput
- Routes events to different destinations based on a field value at runtime (Correct answer)
- Balances load between multiple Cribl leaders
- Selects the fastest available network path
Correct answer: Routes events to different destinations based on a field value at runtime
The Dynamic Router function uses a field's value to determine the destination or pipeline for each event, enabling field-driven routing logic.
Question 6: In Cribl Stream, which source type would you configure to receive data pushed via HTTP POST requests with a bearer token?
- Syslog Source
- HTTP Source (Correct answer)
- Kafka Source
- S3 Collector
Correct answer: HTTP Source
The HTTP Source listens for incoming HTTP POST requests and supports authentication methods including bearer tokens.
Question 7: What does enabling 'Persistent Queuing' on a Cribl Stream output do?
- Stores all events indefinitely in a database
- Buffers events to disk so they survive destination outages (Correct answer)
- Compresses events before writing to disk
- Enables encryption for all outgoing data
Correct answer: Buffers events to disk so they survive destination outages
Persistent Queuing writes events to a local disk queue, ensuring no data loss if a destination becomes temporarily unavailable.
Cribl Data Routing & Processing 4
Which Cribl Stream function converts individual events into multiple separate events?