Cribl Data Transformation & Enrichment 2

Question 1

The Serialize function in Cribl Stream converts event fields into which output representation?

Accepted Answer

A string in formats like JSON or CSV

Answer

Serialize takes event fields and converts them into a string representation in a chosen format (e.g., JSON, CSV, KV), typically placing the result into _raw.

Question 2

When the Regex Extract function's pattern does not match the target field, what happens to the event by default?

Accepted Answer

The event passes through unchanged

Answer

If the regex does not match, Cribl's Regex Extract function leaves the event unmodified and allows it to continue downstream without dropping or erroring.

Question 3

What is the primary use case for the Suppress function in Cribl Stream?

Accepted Answer

Deduplicating or rate-limiting repetitive events over a configurable time window

Answer

The Suppress function tracks event signatures over a time window and drops repetitive events after a configurable number of occurrences, reducing noisy alert storms.

Question 4

In Cribl's Eval function, which special variable holds the raw, unparsed text of an event?

Accepted Answer

_raw

Answer

The _raw field is the reserved Cribl variable that contains the original, unmodified event text and is available for reading or rewriting in Eval expressions.

Question 5

Which Cribl function is specifically designed to mask, hash, or redact sensitive data such as PII or credit card numbers?

Accepted Answer

Mask

Answer

The Mask function applies replacement or hashing rules to field values that match a pattern, allowing sensitive data to be obfuscated before routing to destinations.

(Cribl) Cribl Observability Pipeline Certification Practice Test

(Cribl) Cribl Observability Pipeline Certification Practice Test

Cribl Data Transformation & Enrichment 2