Cribl Pipeline Management & Optimization 3

Question 1

In Cribl Stream, what is the effect of enabling 'Final' on a pipeline route?

Accepted Answer

No further routes are evaluated after this route matches an event

Answer

Marking a route as Final stops route evaluation once it matches, preventing events from being processed by any later routes.

Question 2

Which built-in Cribl Stream variable holds the raw, unparsed text of the original event?

Accepted Answer

_raw

Answer

The `_raw` field contains the original unparsed event text and is the standard reference for raw log data in Cribl.

Question 3

When using the 'Sampling' function in a pipeline, what happens to events that are NOT selected in the sample?

Accepted Answer

They are dropped

Answer

Events not selected by the Sampling function are discarded, reducing data volume at the cost of completeness.

Question 4

What is the primary role of a 'Pre-Processing Pipeline' in Cribl Stream source configuration?

Accepted Answer

Apply transformations before data is routed through the main pipeline system

Answer

Pre-processing pipelines run at the source level before routing, allowing early normalization or filtering before events reach route-based pipelines.

Question 5

A pipeline's Eval function uses `C.env('SECRET_KEY')` — what does this accomplish?

Accepted Answer

Accesses an OS environment variable set on the worker node

Answer

`C.env()` reads OS-level environment variables available to the Cribl worker process, useful for injecting configuration without hardcoding values.

(Cribl) Cribl Observability Pipeline Certification Practice Test