Cribl Pipeline Management & Optimization 5

Question 1

What is the impact of setting a very high 'Max Buffer Size' in a Cribl Stream persistent queue configuration?

Accepted Answer

Increased disk usage but greater protection against destination outages

Answer

A larger max buffer size allows more events to be queued on disk during a destination outage, at the cost of additional storage consumption.

Question 2

Which metric in Cribl Stream's pipeline monitoring indicates the percentage of events being dropped by pipelines?

Accepted Answer

Drop Rate

Answer

Drop Rate reports the fraction of events discarded by pipeline functions such as Suppress, Sampling, or explicit drop conditions.

Question 3

A Cribl Stream pipeline uses a Lookup function with 'Ignore Case' enabled. What is the trade-off?

Accepted Answer

Slightly higher CPU cost per lookup due to case normalization before key comparison

Answer

Case-insensitive lookup normalizes the key (typically lowercasing) before the hash comparison, adding a small but consistent CPU overhead per event.

Question 4

In Cribl Stream, what happens when a pipeline's Eval function throws a JavaScript runtime error?

Accepted Answer

The event passes through with the function skipped, and an error counter increments

Answer

Cribl isolates function errors per-event; the event continues through the pipeline but the failed function is skipped and the error is counted in metrics.

Question 5

Which approach best reduces egress costs when sending data from Cribl Stream to a cloud-based SIEM?

Accepted Answer

Using the Aggregation function to reduce event count before forwarding

Answer

The Aggregation function summarizes multiple events into statistical rollups (count, sum, avg), dramatically reducing event volume and thus egress costs.

(Cribl) Cribl Observability Pipeline Certification Practice Test

(Cribl) Cribl Observability Pipeline Certification Practice Test

Cribl Pipeline Management & Optimization 5