Cribl Pipeline Management & Optimization 4

Question 1

What is the purpose of the 'Throttle' function in a Cribl Stream pipeline?

Accepted Answer

Limit the rate of events passing through to prevent overwhelming downstream systems

Answer

The Throttle function caps event throughput at a configured rate, protecting downstream systems from traffic spikes.

Question 2

In Cribl Stream, which lookup file format provides the fastest field-match lookups?

Accepted Answer

CSV with index column

Answer

CSV files with an indexed key column allow O(1) hash-based lookups in memory, making them the fastest format for enrichment.

Question 3

A pipeline is configured with two routes: Route A (Final=false) and Route B. An event matches Route A. Which statement is correct?

Accepted Answer

Both Route A and Route B process the event if it also matches Route B's filter

Answer

When Final is false, Cribl continues evaluating subsequent routes, so an event can match and be processed by multiple routes.

Question 4

What does the `__srcIpPort` internal field in Cribl Stream represent?

Accepted Answer

The source IP address and port from which the event was received

Answer

`__srcIpPort` captures the network source (IP:port) of the incoming connection, useful for tagging events with their origin.

Question 5

Which Cribl Stream feature enables you to define reusable JavaScript logic and import it across multiple pipelines?

Accepted Answer

Global Functions (Libraries)

Answer

Global Functions (Libraries) let you write shared JavaScript functions once and import them into any pipeline's Eval or other scripting contexts.

(Cribl) Cribl Observability Pipeline Certification Practice Test