Cribl Source & Destination Configuration 3

Question 1

What is the primary purpose of enabling a Persistent Queue (PQ) on a Cribl destination?

Accepted Answer

Store events on disk when the destination is unavailable

Answer

Persistent Queue stores events to disk so they can be delivered later if the destination is temporarily unavailable, preventing data loss.

Question 2

In which scenario would you configure a pre-processing pipeline directly on a Cribl source?

Accepted Answer

To apply transformations before events enter the main routing table

Answer

A pre-processing pipeline on a source applies transformations or filtering to events before they are passed to the main routing and pipeline system.

Question 3

What controls when the Cribl S3 destination creates a new object (file) in the target bucket?

Accepted Answer

The max file size and flush period settings

Answer

The max file size and flush period settings together determine when Cribl closes the current object and starts a new one in S3.

Question 4

What is the default behavior when a Cribl destination's Persistent Queue reaches its configured maximum disk size?

Accepted Answer

New incoming events are blocked or dropped based on the backpressure behavior setting

Answer

When the PQ is full, Cribl applies backpressure to block or drop new events depending on the configured backpressure behavior setting.

Question 5

Which setting in a Cribl HTTP destination controls how many events are grouped together in a single outbound HTTP request?

Accepted Answer

Batch size

Answer

The batch size setting determines how many events Cribl groups into a single payload before sending one HTTP request to the destination.

(Cribl) Cribl Observability Pipeline Certification Practice Test