Cribl Pipeline Management & Optimization 4 — Questions and Answers
Question 1: What is the purpose of the 'Throttle' function in a Cribl Stream pipeline?
- Limit the rate of events passing through to prevent overwhelming downstream systems (Correct answer)
- Compress events to reduce bandwidth usage
- Pause pipeline execution during maintenance windows
- Buffer events until a minimum batch size is reached
Correct answer: Limit the rate of events passing through to prevent overwhelming downstream systems
The Throttle function caps event throughput at a configured rate, protecting downstream systems from traffic spikes.
Question 2: In Cribl Stream, which lookup file format provides the fastest field-match lookups?
- JSON
- CSV with index column (Correct answer)
- YAML
- Parquet
Correct answer: CSV with index column
CSV files with an indexed key column allow O(1) hash-based lookups in memory, making them the fastest format for enrichment.
Question 3: A pipeline is configured with two routes: Route A (Final=false) and Route B. An event matches Route A. Which statement is correct?
- Only Route A processes the event
- Both Route A and Route B process the event if it also matches Route B's filter (Correct answer)
- Route B is skipped regardless of its filter
- The event is cloned — one copy goes to each matching route
Correct answer: Both Route A and Route B process the event if it also matches Route B's filter
When Final is false, Cribl continues evaluating subsequent routes, so an event can match and be processed by multiple routes.
Question 4: What does the `__srcIpPort` internal field in Cribl Stream represent?
- The destination IP and port of the output connection
- The source IP address and port from which the event was received (Correct answer)
- The Cribl worker's own IP and listening port
- The IP of the leader node in a distributed deployment
Correct answer: The source IP address and port from which the event was received
`__srcIpPort` captures the network source (IP:port) of the incoming connection, useful for tagging events with their origin.
Question 5: Which Cribl Stream feature enables you to define reusable JavaScript logic and import it across multiple pipelines?
- Global Variables
- Knowledge Objects
- Global Functions (Libraries) (Correct answer)
- Pipeline Templates
Correct answer: Global Functions (Libraries)
Global Functions (Libraries) let you write shared JavaScript functions once and import them into any pipeline's Eval or other scripting contexts.
Question 6: When would you use 'Event Breaker' rules in a Cribl Stream pipeline?
- To split a single incoming payload containing multiple concatenated events into individual events (Correct answer)
- To halt pipeline execution when a malformed event is detected
- To partition events across worker threads for parallel processing
- To merge small events into larger batches for efficiency
Correct answer: To split a single incoming payload containing multiple concatenated events into individual events
Event Breaker rules define boundaries (regex, JSON arrays, timestamp patterns) to split multi-event payloads into discrete individual events.
Question 7: In a Cribl pipeline, what is the correct way to conditionally apply a function only to events where field 'level' equals 'ERROR'?
- Set the function's 'Filter' property to `level == 'ERROR'` (Correct answer)
- Wrap the function in an if-block within the pipeline JSON
- Use a separate route with filter `level == 'ERROR'` pointing to a dedicated pipeline
- Add a pre-condition script at the pipeline level
Correct answer: Set the function's 'Filter' property to `level == 'ERROR'`
Every pipeline function has a Filter field that accepts a JavaScript expression; the function only executes when the expression evaluates to true.
Cribl Pipeline Management & Optimization 4
What is the purpose of the 'Throttle' function in a Cribl Stream pipeline?