Cribl Pipeline Management & Optimization 3 — Questions and Answers
Question 1: In Cribl Stream, what is the effect of enabling 'Final' on a pipeline route?
- The route processes events and then passes them to subsequent matching routes
- No further routes are evaluated after this route matches an event (Correct answer)
- The pipeline is marked as read-only
- Events matching this route are duplicated to all outputs
Correct answer: No further routes are evaluated after this route matches an event
Marking a route as Final stops route evaluation once it matches, preventing events from being processed by any later routes.
Question 2: Which built-in Cribl Stream variable holds the raw, unparsed text of the original event?
- __rawEvent
- _raw (Correct answer)
- event.original
- _message
Correct answer: _raw
The `_raw` field contains the original unparsed event text and is the standard reference for raw log data in Cribl.
Question 3: When using the 'Sampling' function in a pipeline, what happens to events that are NOT selected in the sample?
- They are sent to a secondary output
- They are queued for delayed delivery
- They are dropped (Correct answer)
- They bypass the pipeline and go directly to the destination
Correct answer: They are dropped
Events not selected by the Sampling function are discarded, reducing data volume at the cost of completeness.
Question 4: What is the primary role of a 'Pre-Processing Pipeline' in Cribl Stream source configuration?
- Apply transformations before data is routed through the main pipeline system (Correct answer)
- Compress data before writing to persistent queues
- Validate schema compliance before ingestion
- Generate metadata tags for downstream ML models
Correct answer: Apply transformations before data is routed through the main pipeline system
Pre-processing pipelines run at the source level before routing, allowing early normalization or filtering before events reach route-based pipelines.
Question 5: A pipeline's Eval function uses `C.env('SECRET_KEY')` — what does this accomplish?
- Reads a Cribl-managed secret from the credential store
- Accesses an OS environment variable set on the worker node (Correct answer)
- Calls an external secrets manager API
- Retrieves a key from the Cribl key-value store
Correct answer: Accesses an OS environment variable set on the worker node
`C.env()` reads OS-level environment variables available to the Cribl worker process, useful for injecting configuration without hardcoding values.
Question 6: Which pipeline optimization strategy reduces the number of function executions by eliminating events early in the pipeline?
- Moving Drop or Filter functions to the beginning of the pipeline (Correct answer)
- Using asynchronous function execution
- Increasing worker process count
- Enabling pipeline compression
Correct answer: Moving Drop or Filter functions to the beginning of the pipeline
Placing drop or filter functions early ensures ineligible events are discarded before reaching expensive transformation functions downstream.
Question 7: In Cribl Stream, what does the 'Clone' function do to an event?
- Backs up the event to persistent queue before transformation
- Creates one or more copies of the event and injects them into the pipeline (Correct answer)
- Duplicates the event to a secondary output destination
- Saves event state for later replay
Correct answer: Creates one or more copies of the event and injects them into the pipeline
The Clone function creates additional copies of an event within the pipeline, useful for sending modified versions to different outputs.
Cribl Pipeline Management & Optimization 3
In Cribl Stream, what is the effect of enabling 'Final' on a pipeline route?