Cribl Data Transformation & Enrichment 3

Question 1

Which Cribl function and format combination is best suited for converting syslog-formatted events into structured key-value fields?

Accepted Answer

Parser configured with the Syslog format

Answer

Eval with custom JS

Answer

JSON Unpack

Answer

Regex Extract with a syslog pattern

Question 2

Which items are categorized as Knowledge Objects in Cribl Stream?

Accepted Answer

Lookups, GeoIP databases, and Global Variables

Answer

Pipeline configurations and route definitions

Answer

Worker group certificates and TLS settings

Answer

Source and destination authentication credentials

Question 3

What is the purpose of the Aggregations function in Cribl Stream?

Accepted Answer

To compute statistics like sum, count, and average over a time window and emit result events

Answer

To merge multiple pipelines into a single processing flow

Answer

To concatenate field values from consecutive events into one

Answer

To combine events from multiple sources into a single enriched event

Question 4

When the Lookup function is set to 'Add to Event' mode and the lookup key is not found in the CSV, what is the default behavior?

Accepted Answer

The event passes through without any additional fields added

Answer

The event is dropped from the pipeline

Answer

Matched fields are added with null values

Answer

An error event is generated and routed separately

Question 5

In Cribl's Eval function, which JavaScript built-in object is available for working with dates and timestamps?

Accepted Answer

Date

Answer

Time

Answer

DateTime

Answer

Moment

Question 6

In the Suppress function, what does the 'Min Occurrences' setting control?

Accepted Answer

The minimum number of matching events that must occur before suppression activates

Answer

The minimum number of events required before pipeline sampling begins

Answer

The minimum number of fields an event must contain to pass through

Answer

The minimum time interval between unique events before suppression resets

Question 7

Which Cribl function is used to unroll an array field, generating one separate event for each element in the array?

Accepted Answer

Unroll

Answer

Clone

Answer

Expand

Answer

Flatten