Cribl Source & Destination Configuration — Questions and Answers

Question 1: Which destination is used for sending data to Splunk?

Syslog
Kafka
Splunk HEC (Correct answer)
Amazon S3

Correct answer: Splunk HEC

Splunk HEC (HTTP Event Collector) is a common and efficient method for sending data to Splunk indexers. Cribl provides a dedicated Splunk HEC destination type, allowing it to seamlessly forward processed observability data to Splunk for indexing, storage, and subsequent analysis.

Question 2: Which source ingests files from a directory?

Syslog
HTTP Collector
File Monitor (Correct answer)
Metrics

Correct answer: File Monitor

The `File Monitor` input in Cribl is designed to ingest log data from files residing in specified directories on the file system. It continuously monitors these files for new entries, allowing Cribl to collect both historical and real-time log data from local or mounted storage locations.

Question 3: What is required when setting up a destination?

Data size only
User role
File type
Hostname, port, protocol (Correct answer)

Correct answer: Hostname, port, protocol

When configuring a destination in Cribl, essential network details are required to establish connectivity with the target system. This typically includes the hostname or IP address of the destination, the specific port it listens on, and the communication protocol (e.g., TCP, UDP, HTTP) to be used for data transmission.

Question 4: Which cloud storage can Cribl output to?

Dropbox
Box
Amazon S3 (Correct answer)
OneDrive

Correct answer: Amazon S3

Cribl supports outputting processed data to various cloud storage services for archiving or further analysis. Amazon S3 (Simple Storage Service) is a widely used and supported destination, allowing users to store large volumes of data securely and cost-effectively in the AWS cloud.

Question 5: Which source captures log data from network ports?

File Monitor
TCP/UDP (Correct answer)
Metrics
Webhook

Correct answer: TCP/UDP

The `TCP/UDP` input in Cribl is specifically designed to capture log data that is sent over network ports using either the TCP or UDP protocols. This allows Cribl to act as a listener for various network-based log sources, such as Syslog, NetFlow, or custom application streams, enabling real-time ingestion.

Question 6: What is a best practice when configuring inputs?

Disable logs
Compress files
Use filters to limit ingestion (Correct answer)
Route to localhost

Correct answer: Use filters to limit ingestion

A best practice when configuring inputs is to apply filters as early as possible to limit the amount of data ingested into the pipeline. This reduces unnecessary processing, saves compute resources, and ensures that only relevant data enters the observability pipeline, improving overall efficiency and reducing costs.

Question 7: Which destination can forward to an indexer?

Wi-Fi router
Printer
Indexer (Splunk/Elastic) (Correct answer)
Text editor

Correct answer: Indexer (Splunk/Elastic)

An indexer, such as those found in Splunk or Elasticsearch, is a primary destination for processed observability data. Cribl's role is often to prepare, enrich, and optimize data before forwarding it to these indexers, where it is stored, indexed, and made searchable for analysis by users.

Question 8: Which input supports JSON data?

UDP
TCP
File Monitor
HTTP Collector (Correct answer)

Correct answer: HTTP Collector

The `HTTP Collector` input in Cribl is designed to receive data via HTTP POST requests, making it ideal for ingesting structured data formats like JSON. Many applications and services can send JSON payloads directly to an HTTP endpoint, which Cribl can then efficiently process within its pipelines.

Question 9: What is a stream in Cribl?

Encrypted file
Firewall rule
Logical data flow definition (Correct answer)
CLI path

Correct answer: Logical data flow definition

In Cribl, a stream represents a logical definition of how data flows through the system. It defines the sequence of pipelines and functions that data will traverse from its source to its destination. This allows for flexible and organized processing of observability data.

Cribl Source & Destination Configuration

Which destination is used for sending data to Splunk?