Cribl Data Transformation & Enrichment 3

Question 1

Which Cribl function and format combination is best suited for converting syslog-formatted events into structured key-value fields?

Accepted Answer

Parser configured with the Syslog format

Answer

The Parser function has a built-in Syslog format that understands RFC 3164/5424 headers and automatically extracts fields like severity, facility, host, and message.

Question 2

Which items are categorized as Knowledge Objects in Cribl Stream?

Accepted Answer

Lookups, GeoIP databases, and Global Variables

Answer

Knowledge Objects in Cribl Stream include Lookups (CSV files), GeoIP databases, Global Variables, and Parser rules — reusable assets shared across pipelines.

Question 3

What is the purpose of the Aggregations function in Cribl Stream?

Accepted Answer

To compute statistics like sum, count, and average over a time window and emit result events

Answer

The Aggregations function collects events over a configurable time window, computes statistical metrics, and emits a single aggregated result event, reducing volume while preserving insights.

Question 4

When the Lookup function is set to 'Add to Event' mode and the lookup key is not found in the CSV, what is the default behavior?

Accepted Answer

The event passes through without any additional fields added

Answer

By default, if no matching row is found in the lookup CSV, the Lookup function takes no action and the event continues downstream without the enrichment fields.

Question 5

In Cribl's Eval function, which JavaScript built-in object is available for working with dates and timestamps?

Accepted Answer

Date

Answer

Standard JavaScript's Date object is available in Cribl's Eval function for creating, parsing, and manipulating timestamps within event processing expressions.

(Cribl) Cribl Observability Pipeline Certification Practice Test

(Cribl) Cribl Observability Pipeline Certification Practice Test

Cribl Data Transformation & Enrichment 3