CriblVision v4.3.0

CriblVision for Splunk version 4.3.0 contains some exciting new updates to the Commit and Deploy Audit Logs dashboard!

This dashboard has been updated to include the following updates:

• A timeline of the commits and deploys over the selected time period
• Updated the summary table to include the commit message
• Added a drilldown to the created, modified, and deleted file columns that show the configuration changes made to a particular file as part of the given commit

These updates provide further context when troubleshooting commits and deploys that may have impacted your Cribl Stream environnent.

NB: The CriblVision for Splunk Pack v1.1.1+ is required with the Git Commit Logs Collector Job configured to make full use of this dashboard. This Pack can be found in the Packs Dispensary .

CriblVision v4.2.2

CriblVision v4.2.2 provides a fix for a bug in the Route/Pipeline Reduction dashboard, where Routes/Pipelines with whitespace in their name were generating incorrect SPL.

CriblVision v.4.2.1

CriblVision v4.2.1 contains a fix to the Worker Process Count panel to use a metrics search rather than an events search on the Sizing Calculator dashboard.

Note that the ELU percentage panel still uses an event search instead of a metrics search. This is because the ELU metrics are not reported from the Cribl Stream internal metrics Source.

CriblVision v4.2.0

CriblVision 4.2.0 includes an updated Sizing Calculator dashboard. It now uses metrics to run the searches (except the ELU CPU % panel) to allow the Cribl.Cloud users to assess the sizing of their environments!

CriblVision v4.1.1

CriblVision v4.1.1 contains some quality of life updates to dashboards:

• The Health Check dashboard has been updated to use metric sources for CPU and Memory panels to improve performance.
• All relevant dashboards have been updated to include a Bytes Unit dropdown that allows the user to select the bytes unit measurement used on that dashboard. This defaults to GB.

CriblVision v4.1.0

CriblVision version 4.1.0 comes with a new dashboard detailing reductions made in event size/amount by Routes and Pipelines!

It provides an overview of the total reductions made, as well as a view of reductions over time. Time series panels are overlayed with commit history to show how previous commits may have impacted reduction amounts. If you have the Cribl Redux Stats Pack installed in your environment, this dashboard also provides options for reporting these stats too!

This new dashboard is accessible via the Configuration dropdown in the CriblVision navigation bar.

CriblVision v4.0.0

CriblVision v4.0.0 comes with updates that utilize the new CriblVision for Splunk Pack! The Pack contains templates for REST API Collector jobs that can be run against the Cribl Stream API to retrieve additional context on Leaders, Workers, Single, and Edge Nodes. These events are used by the Populate Cribl Stream Asset Lookup Report to more accurately define the instance types of each Cribl Stream/Edge instance. The precedence for determining the instance type is now:

1. Data obtained through the REST API.
2. The previously inferred instance type.
3. The instance type as calculated from the retrieved logs/metrics.
   If you are not using the CriblVision for Splunk Pack and utilizing the REST API Collector jobs, it is possible to update the cribl_stream_assets lookup file directly to set the instance type as desired.

This release comes with support to filter on Fleets and individual Edge Nodes on each of the relevant dashboards. On top of this, the following dashboard changes have also been made:

• The Active vs Total panels on the Cribl Stream Assets dashboard now drilldown to a breakdown by environment.
• If the Splunk App for Lookup File Editing is installed, a link to the cribl_stream_assets lookup file is included at the bottom of the Cribl Stream Assets dashboard for easy editing.
• The Persistent Queue Analytics dashboard has been updated to include both Source and Destination persistent queues.

CriblVision v3.2.2

CriblVision 3.2.2 is a maintenance release to fix how memory usage is getting calculated. Previously aggregations where being done per worker process, which was reporting less memory usage than expected. These calculations have been updated to sum the memory usage per worker process before continuing with further aggregations.

To ensure that your dashboards and alerts work smoothly when upgrading to version 3.x from version 2.x, please do the following:

1. Install version 3.x of CriblVision
2. Run the CriblVision setup age again:
   1. From the Apps dropdown, select Manage Apps
   2. Selected the Set up action for CriblVision
   3. Follow the instructions on the setup page
3. Run the Populate Cribl Stream Assets Lookup report by either:
   • Clicking the button on the landing page
   • Clicking the link in the navigation bar
4. Double check that any alerts that were enabled are still enabled

If there are issues after completing these steps, you may need to clear your browser cache to clear cached scripts in Splunk. Clear the browser cache and follow from instructions from step 2 onwards.

These instructions are also available in the README. For installing the application by means other than the UI, please refer to the README configuration notes to apply the required configuration.

CriblVision v3.2.1

CriblVision v3.2.1 is a maintenance release to do some tidy up of alerts:

• Fixed a typo in the CPU Usage Over Threshold alert
• Removed unnecessary fields from alert outputs

To ensure that your dashboards and alerts work smoothly when upgrading to version 3.x from version 2.x, please do the following:

1. Install version 3.x of CriblVision
2. Run the CriblVision setup age again:
   1. From the Apps dropdown, select Manage Apps
   2. Selected the Set up action for CriblVision
   3. Follow the instructions on the setup page
3. Run the Populate Cribl Stream Assets Lookup report by either:
   • Clicking the button on the landing page
   • Clicking the link in the navigation bar
4. Double check that any alerts that were enabled are still enabled

If there are issues after completing these steps, you may need to clear your browser cache to clear cached scripts in Splunk. Clear the browser cache and follow from instructions from step 2 onwards.

These instructions are also available in the README. For installing the application by means other than the UI, please refer to the README configuration notes to apply the required configuration.

CriblVision v3.2.0

CriblVision v3.2.0 introduces a new dashboard for troubleshooting Cribl Stream instances that may be dropping events or experiencing subsecond timestamp issues when forwarding to Splunk using the S2S protocol. This dashboard can be accessed from the Configuration dropdown on the CriblVision navigation menu, or there is a link to it from the Welcome page under the Logs and Metrics section.

To ensure that your dashboards and alerts work smoothly when upgrading to version 3.x from version 2.x, please do the following:

1. Install version 3.x of CriblVision
2. Run the CriblVision setup age again:
   1. From the Apps dropdown, select Manage Apps
   2. Selected the Set up action for CriblVision
   3. Follow the instructions on the setup page
3. Run the Populate Cribl Stream Assets Lookup report by either:
   • Clicking the button on the landing page
   • Clicking the link in the navigation bar
4. Double check that any alerts that were enabled are still enabled

If there are issues after completing these steps, you may need to clear your browser cache to clear cached scripts in Splunk. Clear the browser cache and follow from instructions from step 2 onwards.

These instructions are also available in the README. For installing the application by means other than the UI, please refer to the README configuration notes to apply the required configuration.