Single-Instance/Basic Deployment | Cribl Docs

For the complete documentation index, see llms.txt.

Cribl Stream Cribl Edge Cribl Search Cribl Lake Cribl Insights

Known Issues Release Notes What's New Cribl Copilot

Sandbox GitHub Repos Docker Hub Cribl as Code

(Ctrl+K / Cmd+K)

No Results Try to type a different keyword or phrase

What are you looking for? Type a keyword or phrase above

All Results Press Enter

API Reference Cribl Status Cribl.Cloud

4.6

Release Notes 4.20 4.19 4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

4.6

4.20 4.19 4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

About Cribl Stream Basic Concepts Getting Started Guide Distributed Quick Start

Initial Cribl.Cloud Setup Cribl.Cloud Portal Managing Cribl.Cloud Cribl.Cloud vs. Self-Hosted Enterprise Cloud

Cloud SSO Setup

Common SSO Setup Steps OIDC/Okta Setup Example SAML/Microsoft Entra ID Setup Examples SAML/Okta Setup Examples Final SSO Steps & Troubleshooting

Deploying Cribl Stream Software

Planning and Sizing

Deployment Planning Sizing and Scaling Architectural Considerations Ports

Manual Deployment

Deployment Types Single-Instance/Basic Deployment Distributed Deployment Splunk App Deployment Bootstrap Workers from Leader Leader High Availability/Failover Converting a Single Instance to Distributed Deployment

Orchestrated Deployment

Kubernetes/Helm Deployment Kubernetes Worker Deployment

Docker Deployment

Reference Architectures

All-in-One Reference Architecture Syslog Reference Architecture Multiple Agents Reference Architecture Comprehensive Reference Architecture Comprehensive Hybrid Cloud Reference Architecture

Configuring Workspaces Members and Teams

Configuring Projects Configuring Subscriptions Adding Users to Projects

Licensing Version Control GitOps Group/Fleet Settings

Source-State Notifications Destination-State Notifications License-Expiration Notifications Email Notifications

Notification Targets

Webhook Notification Targets PagerDuty Notification Targets Slack Notification Targets AWS SNS Notification Targets Email Notification Targets

Customizing the interface

Custom Banners Custom Login Page

Scripts Upgrading Uninstalling

Access Management

Authentication Members and Permissions Local Users Roles SSO with Okta and OIDC SSO with Okta and SAML

FIPS Mode How to Secure the Auth Token for the Leader Node

Securing Cribl Stream (TLS/SSL, Certs, Keys)

KMS Configuration

Securing Communications System Proxy Configuration

Encryption Decryption

Encrypting Sensitive Data AWS Cross-Account Data Collection RHEL 8 Security Technical Implementation Guide SELinux Configuration

Internal Metrics Internal Logs

Working With Data

Event Model Event Processing Order Routes Pipelines

Packs Publication Standards

Using Datagens Data Preview Data Onboarding

Auto Timestamp Aggregations CEF Serializer Chain Clone Code Comment DNS Lookup Drop Dynamic Sampling Eval Event Breaker Flatten GeoIP Grok JSON Unroll Lookup Mask Numerify OTLP Metrics Parser Publish Metrics Redis Regex Extract Regex Filter Rename Rollup Metrics Sampling Serialize Suppress Tee Trim Timestamp Unroll XML Unroll Prometheus Publisher (Deprecated)Reverse DNS (deprecated)

Collector Sources

Azure Blob Storage Cribl Lake Database Filesystem/NFS Google Cloud Storage Health Check REST / API Endpoint S3 Script Splunk Search Manage Collector State in Database and REST API Collectors Scheduling and Running Job Limits

Amazon Kinesis Firehose Amazon Kinesis Streams Amazon S3 Amazon SQS

Azure Blob Storage Azure Event Hubs

Google Cloud Pub/Sub

Kafka Confluent Cloud Amazon MSK

Office 365 Activity Office 365 Message Trace Office 365 Services

Prometheus Scraper Prometheus Remote Write Grafana Loki

Splunk HEC Splunk Search Splunk TCP

Cribl Internal Cribl HTTP Cribl TCP Cribl Stream (Deprecated)

Datagen Exec File Monitor Journal Files System Metrics System State

AppScope CrowdStrike FDR Datadog Agent Elasticsearch API HTTP/S (Bulk API)Raw HTTP/S Metrics Model Driven Telemetry NetFlow OpenTelemetry (OTel)SNMP Trap Syslog TCP JSON TCP (Raw)UDP (Raw)Windows Event Forwarder Wiz

Amazon CloudWatch Logs Amazon Kinesis Streams Amazon S3 Compatible Stores Amazon SQS

Azure Blob Storage Azure Data Explorer Azure Event Hubs Azure Monitor Logs Azure Sentinel

Cribl Lake Amazon S3 Amazon Security Lake

Elasticsearch Elastic Cloud

Google SecOps Google Cloud Logging Google Cloud Pub/Sub Google Cloud Storage

Kafka Confluent Cloud Amazon MSK

Graphite StatsD StatsD Extended

New Relic Ingest

New Relic Events New Relic Logs & Metrics

Prometheus Grafana Cloud Loki

Splunk HEC Splunk Single Instance Splunk Load Balanced

Cribl HTTP Cribl TCP Cribl Stream (Deprecated)Default DevNull Output Router

CrowdStrike Falcon LogScale Datadog Exabeam Filesystem/NFS Honeycomb InfluxDB MinIO OpenTelemetry (OTel)SentinelOne DataSet SignalFx SNMP Trap Sumo Logic Syslog TCP JSON Wavefront Webhook

Using Integrations

About Load Balancing Destination Backpressure Triggers

Persistent Queues

Planning for Persistent Queues Configuring Persistent Queues Persistent Queues Support

Cribl Edge to Cribl Stream

Using Collectors

Using S3 Storage and Replay Using REST/API Collectors Lacework API Collection Microsoft Graph API Collection ServiceNow API Collection Creating a Custom Collector

Integrating with Other Services

Amazon S3 Better Practices Amazon Security Lake Integration Collecting Logs from Amazon ECS Containers

Preparing the Azure Workspace Microsoft Entra ID + OpenID Configuration Azure Event Hubs Integrations

Azure Sentinel Integration

DCR Template with Stream Values

Splunk to Elasticsearch Splunk to Exabeam Splunk Stream to Cribl Stream Splunk Cloud and BYOL Integrations

Syslog Best Practices Palo Alto Syslog to Cribl.Cloud

Configuring Upstream Logging Agents BigPanda/Webhook Integration System Metrics to Grafana Kafka Authentication with Kerberos Moogsoft/Webhook Integration Nightfall Integration Managing QRadar Licenses Slack/Webhook Integration Tanium to Cribl Stream Configuring WEF for Cribl Stream Zscaler NSS Integration

Knowledge Libraries

Lookups Library Event Breakers Parsers Library Global Variables Library Regex Library Grok Patterns Library Schemas Library Parquet Schemas Database Connections AppScope Configs

Cribl Expression Syntax

Cribl Expressions

C.Crypto C.Encode and C.Decode C.Lookup C.Mask C.Net C.Text C.Time Other expressions String Date Math Number

CLI Reference Environment Variables

cribl.yml breakers.yml certificates.yml groups.yml inputs.yml instance.yml jobs.yml job-limits.yml licenses.yml limits.yml logger.yml mappings.yml messages.yml outputs.yml parsers.yml perms.yml policies.yml regexes.yml roles.yml samples.yml schemas.yml scripts.yml secrets.yml service.yml vars.yml

Better Practices / Usage Examples

Tips and Tricks

Lookup Applications

Ingest-Time Lookups Managing Large Lookups Lookups as Filters for Masks Lookups and Regex Magic Updating Lookups in Multiple Packs

Sampling Applications

Sampling Sample Logs Access Logs: Apache, ELB, CDN, S3, Etc.Firewall Logs: VPC Flow Logs, Cisco ASA, Etc.

Transformation Applications

Code Function Examples Ingest-Time Fields Masking and Obfuscation Reducing Windows XML Events Regex Filtering

Troubleshooting

Known Issues Diagnosing Issues Common Errors and Warnings Git Push Errors Git Remote Repos & Trusted CAs Sample Logs for Login Scenarios

Videos Third-Party Credits

Known Issues Release Notes

On This Page

Home / Stream/ Deploying Cribl Stream Software· Manual Deployment·Single-Instance/Basic Deployment