Cribl Data Routing & Processing 4

Question 1

Which Cribl Stream function converts individual events into multiple separate events?

Accepted Answer

Unroll

Answer

The Unroll function expands a JSON array field into individual events, one per array element.

Question 2

What is the purpose of the 'Serialize' function in Cribl Stream?

Accepted Answer

Converts structured fields into a serialized format like JSON, CSV, or key=value

Answer

Serialize converts event fields into a formatted string representation such as JSON, CSV, or key=value pairs in the _raw field.

Question 3

In Cribl Stream, a 'Dead Letter Queue' is used to:

Accepted Answer

Capture events that failed to be delivered to their destination

Answer

The Dead Letter Queue captures events that could not be delivered to a destination, allowing inspection and reprocessing without data loss.

Question 4

Which configuration in Cribl Stream controls the maximum number of events buffered before a destination drops data during backpressure?

Accepted Answer

Persistent Queue size

Answer

The Persistent Queue size setting determines how much data can be queued on disk before backpressure causes data loss at a destination.

Question 5

What is the function of the 'Dynamic Router' in Cribl Stream pipelines?

Accepted Answer

Routes events to different destinations based on a field value at runtime

Answer

The Dynamic Router function uses a field's value to determine the destination or pipeline for each event, enabling field-driven routing logic.

(Cribl) Cribl Observability Pipeline Certification Practice Test