Cribl Data Transformation & Enrichment 2

Question 1

The Serialize function in Cribl Stream converts event fields into which output representation?

Accepted Answer

A string in formats like JSON or CSV

Answer

Binary-encoded bytes

Answer

Hex-encoded text

Answer

Base64-encoded blobs

Question 2

When the Regex Extract function's pattern does not match the target field, what happens to the event by default?

Accepted Answer

The event passes through unchanged

Answer

The event is dropped from the pipeline

Answer

An error is logged and processing halts

Answer

Null values are assigned to all named capture groups

Question 3

What is the primary use case for the Suppress function in Cribl Stream?

Accepted Answer

Deduplicating or rate-limiting repetitive events over a configurable time window

Answer

Removing duplicate fields within a single event

Answer

Blocking events based on their source IP address

Answer

Filtering out events that contain null values

Question 4

In Cribl's Eval function, which special variable holds the raw, unparsed text of an event?

Accepted Answer

_raw

Answer

_event

Answer

_text

Answer

__message

Question 5

Which Cribl function is specifically designed to mask, hash, or redact sensitive data such as PII or credit card numbers?

Accepted Answer

Mask

Answer

Lookup

Answer

GeoIP

Answer

Drop

Question 6

What does the Clone function create within a Cribl Stream pipeline?

Accepted Answer

Duplicate copies of events that can be routed independently

Answer

A backup copy of the pipeline configuration

Answer

A copy of a Knowledge Object for safe editing

Answer

A snapshot of the worker process memory state

Question 7

What does the Parser function's 'Auto' format mode attempt to do?

Accepted Answer

Automatically detect and parse the event format without explicit configuration

Answer

Auto-generate regex patterns from sample events

Answer

Select the optimal destination based on event structure

Answer

Dynamically adjust sampling rates based on ingestion throughput