samples.yml
samples.yml
contains metadata about about stored sample data files (size, number of events, date created, name, and so on).
samples.yml
sample_id: # [object]
sampleName: # [string, required] File name - Name of the sample data file with extension
description: # [string] Description - Brief description of this sample file
ttl: # [number] Expiration (hours) - Time to live (TTL) for the sample; reset after each use. Leave empty to never expire
tags: # [string] Tags - One or more tags related to this sample file
created: # [number] Created timestamp - Unix timestamp when sample was created (milliseconds)
modified: # [number] Modified timestamp - Unix timestamp when sample was last modified (milliseconds)
packId: # [string] Pack ID - Pack identifier if sample belongs to a specific pack
isPackOnly: # [boolean] Pack only flag - Whether sample is only available within a pack context
lib: # [string] Library - Library or collection name for organizational purposes
size: # [number] Size - File size in bytes
numEvents: # [number] Event count - Number of events contained in the sample
isTemplate: # [boolean] Template flag - Whether this sample serves as a template
tsTemplateField: # [string] Timestamp template field - Field name to use for timestamp extraction in templates
context: # [object] Context information - Additional context for the sample
id: # [string] Context ID - Identifier for the context
pipelineId: # [string] Context pipeline ID - Associated pipeline for this context
events: # [array] Context events - Array of events for context
The corresponding sample files reside in $CRIBL_HOME/data/samples
.