/

About Cribl Edge

Learn what Cribl Edge is and what it can do for your organization.

Cribl Edge Basic Concepts

Gain a fundamental understanding of Cribl Edge, focusing on the basic concepts.

Getting Started Tutorial

Get data flowing in your own deployment of Cribl Edge by following this quick start tutorial.

Explore Cribl Edge Fleets

Learn how to access Fleets and their Edge Nodes in Cribl Edge.

Explore Cribl Edge on Linux

Take a tour of Linux deployments of Cribl Edge.

Explore Cribl Edge on Windows

Take a tour of Windows deployments of Cribl Edge.

Deployment Planning

Before you deploy Cribl Edge, plan your deployment to suit your environment.

Install Cribl Edge on Linux

Learn how to install Cribl Edge on Linux, including deployment requirements and procedures.

Install Cribl Edge on Windows

Learn how to install Cribl Edge on Windows, including deployment requirements and procedures.

Create and Manage Fleets

Learn how to create and manage Fleets and Subfleets.

Manage Edge Nodes

Explore Edge Nodes, learn how to filter Nodes, and view Edge Node health status.

Understand ways to upgrade Cribl Edge, and learn about upgrade considerations.

Monitor Your Infrastructure with Edge

Combine Cribl Edge with your data visualization tool of choice to monitor your infrastructure.

Kubernetes Observability with Edge

Learn how to capture Kubernetes logs and events, scrape data from Prometheus endpoints, and send data to downstream systems.

Windows Observability with Edge

Walk through a holistic Windows observability guide, so you can collect Windows data and send it to downstream systems.

Integrate with Data Sources and Destinations

Learn how to collect data from Edge Nodes, process and enrich it, then deliver processed data to various endpoints.

Search Your Edge Logs

Jump into Cribl Search – Learn how to search through your Cribl Edge data using Cribl Search.

Send Logs and Metrics to Cribl Lake

Learn how to integrate Cribl Edge with Cribl Lake to store your logs and metrics.

Configure Cribl Edge

Use this guide for practical guidance on configuring your new deployment to collect, process, and forward your Cribl Edge data.

Fleet Hierarchy and Design

Use this guide to understand how to efficiently design your Fleets and Subfleets to maximize Leader health.

Monitor and Troubleshoot Edge

Learn how to implement effective monitoring and troubleshooting strategies to maintain optimal performance and reliability.

Better Practices for Upgrading Edge

Ensure a smooth upgrade for your Cribl Edge environment and requirements.

Common Challenges on the Edge

Review common areas that trip up Cribl Edge users, and our guidance to overcome obstacles.

Cribl Edge to Cribl Stream

Use a Cribl HTTP Source to collect and route data from Edge Nodes to Stream Worker Nodes.

All the docs to goat you started with Cribl Edge.

Download all docs as a PDF – 4.12.2
Download Binary | Edge on Cribl.Cloud
Questions not answered here? We’d love to help you. Meet us in #Cribl Community Slack
Sign up for Cribl Community

Need more help?

Support Ask Cribl Curious Forum Slack Call Us: +1 415-992-6301

4.10

Cribl Suite v4.10

Version 4.10 adds new capabilities and usability improvements to the Cribl product suite and Cribl.Cloud, including:

Notifications on Sources can now trigger on a persistent queue usage condition to alert you when disk usage for a queue exceeds a specified threshold.
Preview feature: The Kubernetes Explorer in Cribl Edge provides a visual interface to explore your Kubernetes clusters and help with configuring log ingestion and breakers.
The Metrics Inspector view in Data Preview introduces a new metrics-first view that enables you to analyze and optimize metrics-heavy data structures with detailed summaries and drill-down insights.
Support for Windows 10 and Windows 11 on laptops or desktops with power management enabled is no longer a preview feature and is now generally available.
The S3 Collector now supports collecting data from Splunk Dynamic Data Self Storage (DDSS) datasets. A new Partitioning scheme dropdown in the S3 Collector settings provides the DDSS option.
A new Zscaler Cloud NSS Source allows you to receive log data from Zscaler Nanolog Streaming Service (NSS) to optimize data for long-term retention, threat analysis, and SIEM integration.
The NetFlow Source has been renamed to NetFlow & IPFIX, and now includes added support for IPFIX (also known as NetFlow v10) and support for template records and options templates.
This release significantly reduces the Cribl Edge installation package size. The cribl/ directory on disk is now under 200 MB, down from over 400 MB, streamlining installations and improving the overall user experience.

Full changelog below.

4.9.3

Cribl Suite v4.9.3

Version 4.9.3 adds new capabilities and usability improvements to the Cribl product suite and Cribl.Cloud, including:

Cribl.Cloud users can now export their monthly invoices directly from the UI. Data can be exported as either CSV or JSON, so you can explore trends on monthly usage, or see how usage is changing by product.
Google Cloud Logging Destination reports accurate Bytes Out metrics within Monitoring views.

Full changelog below.

4.9.2

Cribl Suite 4.9.2

This release corrects a critical issue in Cribl Stream and Cribl Edge 4.9.1, which generated multiple "Dropping malformed HEC event" errors in logs, even with valid incoming HEC payloads. Changelog link below.

4.9.1

Cribl Suite v4.9.1

Version 4.9.1 adds new capabilities and usability improvements to the Cribl product suite and Cribl.Cloud:

Encoding for S3 Sources: The CrowdStrike FDR, Amazon S3, and Amazon Security Lake Sources in Cribl Stream now provide a setting that lets you select the encoding to use when parsing ingested data.
SNMP Function: The new SNMP Trap Serialize Function in Cribl Stream and Cribl Edge converts events into SNMP traps for forwarding to SNMP Trap Destinations.
CriblLogs option: The Cribl Internal Source in Cribl Stream and Cribl Edge now offers the CriblLogs option on Cribl-managed Cribl.Cloud Worker Groups, available for logs relating to Sources and Destinations.
Client Secret authentication for Azure Blob Storage: When using an Azure Blob Storage Dataset Provider in Cribl Search, you can now use the Client Secret authentication method, in addition to the existing authentication methods.
Download invoices: You can now download your monthly Cribl.Cloud invoices for use in external tools, for purposes such as budget planning, analytics, or storage.

4.9

Cribl Suite v4.9

Version 4.9 adds new capabilities and usability improvements to the Cribl product suite and Cribl.Cloud:
New in Cribl Stream:

Persistent Queues: New destination PQ modes, Always on and Backpressure.
REST Collector: Now supports paginated results in Discover.
Global Navigation: Enhanced global navigation experience.

New in Cribl Edge:

Enhanced Filtering: Filter and search nodes based on multiple criteria in Node & Map views.
Windows Laptop Support (Preview): Introduces support for Windows Laptops running Windows 10/11.

New in Cribl Search:

Search Packs (Preview): Introduces a new Packs framework with the ability to create, manage, and install Search-specific Packs directly from the Dispensary. This Preview release is limited to sharing Dashboards only.
Configurable Storage Classes for Object Stores: Gain control over which cloud storage classes are searchable, reducing unexpected access costs and preventing read failures on incompatible storage classes.
Dashboard Scheduling: Schedule searches in advance to power dashboard panels with faster and more efficient data visualization.

New in Cribl.Cloud:

API Token Clients/Secrets: Available at Org/Workspace/Product levels.
Pack Dispensary: Added product filters and permalinks.
Cross-region Support: Enabled for Cloud Workers in AWS.