Cribl Data Transformation & Enrichment

Question 1

Which Cribl function is used to add, update, or delete event fields using JavaScript expressions?

Accepted Answer

Eval

Answer

The Eval function evaluates JavaScript expressions to create, update, or remove fields from events as they flow through a pipeline.

Question 2

In Cribl Stream, the GeoIP function enriches events with geolocation data based on which field type?

Accepted Answer

IP address

Answer

The GeoIP function looks up geolocation metadata (country, city, latitude/longitude) using an IP address field present in the event.

Question 3

What does the Drop function do in a Cribl pipeline?

Accepted Answer

Removes entire events from the pipeline

Answer

The Drop function completely removes matching events from the pipeline, preventing them from reaching any downstream destination.

Question 4

Which Cribl function is used to extract fields from raw text using named capture groups in regular expressions?

Accepted Answer

Regex Extract

Answer

The Regex Extract function applies a regular expression with named capture groups to a source field and promotes the captured values as new event fields.

Question 5

The Lookup function in Cribl Stream uses which type of file to enrich events with additional data?

Accepted Answer

CSV files

Answer

Cribl's Lookup function uses CSV files (uploaded as Knowledge Objects) to match event field values and append additional columns to enriched events.

(Cribl) Cribl Observability Pipeline Certification Practice Test

(Cribl) Cribl Observability Pipeline Certification Practice Test

Cribl Data Transformation & Enrichment