Distributed Deployment | Cribl Docs

For the complete documentation index, see llms.txt.

Cribl Stream Cribl Edge Cribl Search Cribl Lake Cribl Insights

Known Issues Release Notes What's New Cribl Copilot

Sandbox GitHub Repos Docker Hub Cribl as Code

(Ctrl+K / Cmd+K)

No Results Try to type a different keyword or phrase

What are you looking for? Type a keyword or phrase above

All Results Press Enter

API Reference Cribl Status Cribl.Cloud

4.9

Release Notes 4.20 4.19 4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

4.9

4.20 4.19 4.18 4.17 4.16 4.15 4.14 4.13 4.12 4.11 4.10 4.9 4.8 4.7 4.6 4.5 4.4 4.3 4.2 4.1 4.0

About Cribl Stream Cribl Stream Basic Concepts Cribl.Cloud vs. Self-Hosted Cribl Stream Tour Get Started with Cribl Stream Distributed Quick Start

Initial Cribl.Cloud Setup Managing Cribl.Cloud Cribl.Cloud Billing Managing Cribl.Cloud Worker Groups Connecting On-Prem Leaders to Cribl.Cloud Billing Enterprise Cloud Cribl.Cloud Security Practices

Deploying Cribl Stream Software

Planning and Sizing

Deployment Planning Sizing and Scaling Architectural Considerations Ports

On-Prem Deployment

Deployment Types OS and System Requirements Single-Instance/Basic Deployment Run Cribl Stream Configure Cribl Stream for Non-Root User

Distributed Deployment

Set Up Leader and Worker Nodes Manage Worker Groups Map Workers to Worker Groups Manage Config Bundles Deploy Stream Configurations Persistent Socket Connections

Splunk App Deployment Bootstrap Workers from Leader Leader High Availability/Failover Converting a Single Instance to Distributed Deployment

Orchestrated Deployment

Kubernetes/Helm Deployment Kubernetes Worker Deployment Considerations for Cribl Stream on Kubernetes

Docker Deployment

Reference Architectures

All-in-One Reference Architecture Syslog Reference Architecture Multiple Agents Reference Architecture Comprehensive Reference Architecture Comprehensive Hybrid Cloud Reference Architecture

Configuring Workspaces

Configuring Projects Configuring Subscriptions Adding Users to Projects

Licensing Version Control GitOps Group/Fleet Settings

Source-State Notifications Destination-State Notifications License-Expiration Notifications Email Notifications

Notification Targets

Webhook Notification Targets PagerDuty Notification Targets Slack Notification Targets AWS SNS Notification Targets Email Notification Targets

Customizing the Interface

Custom Banners Custom Login Page

Scripts Upgrade Uninstalling

Access Management

Authentication Permissions Members Teams Local Users Roles

Cribl.Cloud SSO

Cribl.Cloud SSO Setup Configuring SSO groups SSO with Okta and OIDC SSO with Microsoft Entra ID and SAML SSO with Okta and SAML SSO Troubleshooting

SSO with Okta and OIDC SSO with Okta and SAML SSO with Microsoft Entra ID and SAML SSO with Microsoft Entra ID and OIDC

Secure your Cribl.Cloud Deployment Secure your On-Prem/Hybrid Deployment

Secure Leader and Communication

Secure the Leader Auth Token TLS Defaults and System-wide Settings Secure Cribl.Cloud with TLS and mTLS Configure mTLS Authentication On-Prem Import Certificates and Keys Configure TLS for API and UI Access Authenticate Sources and Destinations Configure System Proxy Configure SOCKS Proxy

Manage Secrets and Keys

Create and Manage Encryption Keys Create and Manage Secrets Configure KMS Providers

FIPS Mode Running Cribl Stream on a Hardened OS SELinux (Enforcing Mode) Configuration

Internal Metrics Internal Logs

Working With Data

Event Model Event Processing Order Routes

Create Pipelines Using Cribl Copilot

Packs Publication Standards

Using Datagens Data Preview Data Onboarding

Auto Timestamp Aggregations CEF Serializer Chain Clone Code Comment DNS Lookup Drop Dynamic Sampling Eval Event Breaker Flatten GeoIP Grok JSON Unroll Lookup Mask Numerify OTLP Logs OTLP Metrics OTLP Traces Parser Publish Metrics Redis Regex Extract Regex Filter Rename Rollup Metrics Sampling Serialize SNMP Trap Serialize Suppress Tee Unroll XML Unroll Prometheus Publisher (deprecated)Reverse DNS (deprecated)Trim Timestamp (deprecated)

Collector Sources

Azure Blob Storage Cribl Lake Database Filesystem/NFS Google Cloud Storage Health Check REST / API Endpoint S3