November 12, 2018
We’re pleased to unveil our v1.1 release with several new capabilities and a host of new features
This version of Cribl LogStream continues our promise to deliver unique intelligence, control and compliance over your logs and metrics data in real-time. It puts the admins in control and gives users the right data, with the right context, delivered to the right systems to enable operations, security and analytics without pushing every requirement back to developers, vendors or source systems.
Version 1.1 adds support for new sources, new destinations, out-of-the-box content, knowledge library, and introduces a new deployment model focused on scalability.
With this version we started shipping out-of-the-box content in the form of data processing pipelines and knowledge libraries.
Pipelines: This version ships with 3 pipelines that target data sources that are known to have low signal-to-noise ratio. By default, they are passive/not associated with any route but they can be modified per user requirements. In our testing all 3 pipelines showed data savings of over 30%. YMMV.
Knowledge Library: This version also ships with a library of some of the most common regular expressions. Like the pipelines above, the regex library can be extended and users can edit or add their own. Library entries can then be searched, retrieved and used while building functions.
With addition of HEC and Load Balancing to as outputs to multiple Splunk receivers, as well as based on customer demand, we are now updating our guidance for deploying Cribl in a distributed Splunk environment.
The following options are now supported:
Option A: Deploying Cribl on a Splunk Heavy Forwader
Option B: Deploying Cribl on a Splunk Indexer and directly listening for parsed data
Option C: Deploying Cribl on a Splunk Indexer (when no HFs are available)
The recommended and correct option will depend on your requirements and architecture. However, on all cases Cribl will work with parsed data.
I’d be remiss if I didn’t mention FDM – the Fine Dark Mode! Version 1.1 introduces an exquisitely beautiful and disruptive innovation that makes the UI easier on your eyes 🙂 The switch can be found under Settings | Display Settings
If you are interested in Cribl, please check out cribl.io and download your copy to get started. If you’d like more details on installation or configuration, see our documentation. If you need assistance, please join us in Slack #cribl, tweet at us @cribl_io, or contact us via firstname.lastname@example.org. We’d love to help you!
Enjoy it! — The Cribl Team