Cribl Data Transformation & Enrichment 1 — Questions and Answers
Question 1: Which Cribl function is used to add, update, or delete event fields using JavaScript expressions?
- Parser
- Eval (Correct answer)
- Lookup
- Regex Extract
Correct answer: Eval
The Eval function evaluates JavaScript expressions to create, update, or remove fields from events as they flow through a pipeline.
Question 2: In Cribl Stream, the GeoIP function enriches events with geolocation data based on which field type?
- Hostname
- MAC address
- IP address (Correct answer)
- URL
Correct answer: IP address
The GeoIP function looks up geolocation metadata (country, city, latitude/longitude) using an IP address field present in the event.
Question 3: What does the Drop function do in a Cribl pipeline?
- Reduces the sampling rate of events
- Deletes specific fields from an event
- Removes entire events from the pipeline (Correct answer)
- Compresses event data before routing
Correct answer: Removes entire events from the pipeline
The Drop function completely removes matching events from the pipeline, preventing them from reaching any downstream destination.
Question 4: Which Cribl function is used to extract fields from raw text using named capture groups in regular expressions?
- Parser
- Eval
- Regex Extract (Correct answer)
- JSON Unpack
Correct answer: Regex Extract
The Regex Extract function applies a regular expression with named capture groups to a source field and promotes the captured values as new event fields.
Question 5: The Lookup function in Cribl Stream uses which type of file to enrich events with additional data?
- JSON configuration files
- CSV files (Correct answer)
- XML schema files
- Binary index files
Correct answer: CSV files
Cribl's Lookup function uses CSV files (uploaded as Knowledge Objects) to match event field values and append additional columns to enriched events.
Question 6: What is the primary purpose of the Sample function in a Cribl Stream pipeline?
- To test pipeline configurations with synthetic data
- To reduce event volume by keeping only a subset of matching events (Correct answer)
- To generate test events for pipeline validation
- To clone events for parallel destination routing
Correct answer: To reduce event volume by keeping only a subset of matching events
The Sample function reduces data volume by allowing only 1 out of every N matching events to pass through, discarding the rest.
Question 7: Which Cribl function parses a JSON string stored in a single field and promotes its keys as top-level event fields?
- Parser
- Eval
- JSON Unpack (Correct answer)
- Serialize
Correct answer: JSON Unpack
JSON Unpack extracts the key-value pairs from a JSON-encoded string field and flattens them into individual top-level fields on the event.
Cribl Data Transformation & Enrichment 1
Which Cribl function is used to add, update, or delete event fields using JavaScript expressions?