Cribl Data Transformation & Enrichment

Question 1

Which Cribl function is used to add, update, or delete event fields using JavaScript expressions?

Accepted Answer

Eval

Answer

Parser

Answer

Lookup

Answer

Regex Extract

Question 2

In Cribl Stream, the GeoIP function enriches events with geolocation data based on which field type?

Accepted Answer

IP address

Answer

Hostname

Answer

MAC address

Answer

URL

Question 3

What does the Drop function do in a Cribl pipeline?

Accepted Answer

Removes entire events from the pipeline

Answer

Reduces the sampling rate of events

Answer

Deletes specific fields from an event

Answer

Compresses event data before routing

Question 4

Which Cribl function is used to extract fields from raw text using named capture groups in regular expressions?

Accepted Answer

Regex Extract

Answer

Parser

Answer

Eval

Answer

JSON Unpack

Question 5

The Lookup function in Cribl Stream uses which type of file to enrich events with additional data?

Accepted Answer

CSV files

Answer

JSON configuration files

Answer

XML schema files

Answer

Binary index files

Question 6

What is the primary purpose of the Sample function in a Cribl Stream pipeline?

Accepted Answer

To reduce event volume by keeping only a subset of matching events

Answer

To test pipeline configurations with synthetic data

Answer

To generate test events for pipeline validation

Answer

To clone events for parallel destination routing

Question 7

Which Cribl function parses a JSON string stored in a single field and promotes its keys as top-level event fields?

Accepted Answer

JSON Unpack

Answer

Parser

Answer

Eval

Answer

Serialize