Skip to content
This repository has been archived by the owner on Feb 3, 2023. It is now read-only.

Commit

Permalink
Merge pull request #265 from dritanbitincka/update-cribl-brand-names
Browse files Browse the repository at this point in the history
Updating Cribl to Cribl LogStream when referencing the product vs.
  • Loading branch information
guilhemmarchand committed Feb 25, 2021
2 parents 5b2e1eb + 03e23d9 commit 0792735
Showing 1 changed file with 15 additions and 15 deletions.
30 changes: 15 additions & 15 deletions docs/cribl_integration.rst
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
Cribl and TrackMe integration
=============================
Cribl LogStream and TrackMe integration
=======================================

.. image:: img/cribl/cribl_logo.png
:alt: cribl_logo.png
:align: center
:width: 196px

**If you are using Cribl, you can easily integrate TrackMe in a just a few steps, using the excellent native Cribl design, TrackMe will take into account the concept of Cribl pipelines to create, monitor and render the data sources automatically.**
**If you are using Cribl LogStream, you can easily integrate TrackMe in a just a few steps, using the excellent native Cribl LogStream design, TrackMe will take into account the concept of pipelines to create, monitor and render the data sources automatically.**

*In a nutshell:*

- A configuration parameter is available in TrackMe to enable the Cribl mode
- Once activated, the Cribl mode updates the way TrackMe is identifying and breaking the data sources
- To achieve this, TrackMe relies on the **crible_pipe** indexed field automatically created by Cribl when data is indexed in Splunk
- Related searches transparenly use the **crible_pipe** information, that accurately represents the data pipeline as it should be monitored, from Cribl to Splunk
- To achieve this, TrackMe relies on the **cribl_pipe** indexed field automatically created by LogStream when data is indexed in Splunk
- Related searches transparenly use the **cribl_pipe** information, that accurately represents the data pipeline as it should be monitored, from LogStream to Splunk

Enable the Cribl mode
---------------------
Expand All @@ -37,19 +37,19 @@ Cribl mode data sources

**Let's assume the following simple scenario:**

- Cribl receives incoming data from any kind of sources, and streams to Splunk with associated pipelines
- In our example, we instruct Cribl to index data in Splunk into a few indexes, but we have many more pipelines since we perform various operations on Cribl, indexes and sourcetypes are likely fed by much more than just one pipeline
- Cribl LogStream receives incoming data from any kind of sources, and streams to Splunk with associated pipelines
- In our example, we instruct LogStream to index data in Splunk into a few indexes, but we have many more pipelines since we perform various operations on LogStream, indexes and sourcetypes are likely fed by much more than just one pipeline
- In regular TrackMe mode, TrackMe would represent the data sources broken by indexes and sourcetypes, however, this does not represent what the incoming data flow is underneath, and does not provide the valuable information and monitoring layer we need
- Once we enable the Cribl mode, TrackMe relies on the ``cribl_pipe`` pipeline information to properly distinguish the real data flow as it is from the data provider (Cribl) perspective
- Once we enable the Cribl mode, TrackMe relies on the ``cribl_pipe`` pipeline information to properly distinguish the real data flow as it is from the data provider (Cribl LogStream) perspective

*Cribl pipeline examples:*
*Cribl LogStream pipeline examples:*

.. image:: img/cribl/cribl_pipelines.png
:alt: cribl_pipelines.png
:align: center
:width: 1200px

*In this example, the default TrackMe mode has different issues, we stream data to an index called "network", however we have different pipelines that are potentially linked to multiple sources and from the Cribl point of view could be affected independently in case of an issue or misconfiguration:*
*In this example, the default TrackMe mode has different issues, we stream data to an index called "network", however we have different pipelines that are potentially linked to multiple sources and from the LogStream point of view could be affected independently in case of an issue or misconfiguration:*

.. image:: img/cribl/cribl_trackme1.png
:alt: cribl_trackme1.png
Expand All @@ -63,7 +63,7 @@ Cribl mode data sources
:align: center
:width: 1200px

Data sources are created as ``index + ":" + sourcetype + ":" + cribl_pipe``, this represents the data flow from Cirbl to Splunk.
Data sources are created as ``index + ":" + sourcetype + ":" + cribl_pipe``, this represents the data flow from Cribl LogStream to Splunk.

Every search actioned by trackMe now automatically recycles the cribl_pipe information naturally, such as latency tracking, data sampling, open in search buttons, etc:

Expand All @@ -82,10 +82,10 @@ Every search actioned by trackMe now automatically recycles the cribl_pipe infor
:align: center
:width: 1200px

Cribl pre-processing pipelines and cribl_pipe field
---------------------------------------------------
Cribl LogStream pre-processing pipelines and cribl_pipe field
-------------------------------------------------------------

If you have a proprocessing pipelines in your Cribl workflow, the ``cribl_pipe`` field becomes a multi-value indexed field that contains both the processing pipeline and pre-processing pipeline:
If you have a proprocessing pipelines in your LogStream workflow, the ``cribl_pipe`` field becomes a multi-value indexed field that contains both the processing pipeline and pre-processing pipeline:

.. image:: img/cribl/cribl_preprocessing_pipeline.png
:alt: cribl_preprocessing_pipeline.png
Expand Down Expand Up @@ -122,4 +122,4 @@ From the TrackMe point of view, the pre-processing pipeline view has no value an

Congratulations!

You have a now a comprehensive integration between the wonderful and amazing Cribl and TrackMe allowing you to track your Splunk data the easy way!
You have a now a comprehensive integration between the wonderful and amazing Cribl LogStream and TrackMe allowing you to track your Splunk data the easy way!

0 comments on commit 0792735

Please sign in to comment.