Skip to main content

Cribl

Supported Versions

Type

Authentication Type

<=4.0.4

Webhook

Org Bearer Token

Cribl is a vendor-agnostic observability pipeline that gives you the flexibility to collect, reduce, enrich, normalize, and route data from any source to any destination within your existing data infrastructure. Use the Cribl integration to view and manage alerts from the Cribl Stream platform in BigPanda.

Open Integration Manager

The Open Integration Manager is available for use with this integration. For more information, see the Open Integration Manager documentation.

Payload size

Alert payloads must be 6MB or smaller. Larger payloads will fail to process with BigPanda. We recommend reviewing your configurations to ensure that only actionable, useful information is being sent to BigPanda.

Install the Integration

Install the integration by following these steps:

Create a Webhook Destination in Cribl

  1. From a Cribl Stream instance or Group’s Manage submenu, select Data > Destinations.

  2. From the Manage Destinations page tile or the left navigation, select Webhook.

  3. Click New Destination to open the Webhook > New Destination modal.

  4. On the modal’s Configure > General Settings tab, enter or select the following values:

    • URL: https://integrations.bigpanda.io/cribl/alerts

    • Method: POST

    • Format: Custom

    • Content type: application/json

  5. In the Authentication tab, select an Authentication type.

    • Select Auth token, and then enter <Your Org Bearer Token> in the Token field.

    • Alternatively, you can select Auth token (text secret) to expose the Secret drop-down, where you can select a stored secret that references the Access Token. A Create link is available to store a new, reusable secret.

  6. Click Save, then Commit & Deploy. You are now ready to test your Webhook Destination’s communication with BigPanda.

  7. In the Test tab, enter the following test input, then click Run Test.

    [
   {
      "app_key": "<Your App Key>",
      "status": "critical",
      "host": "production-database-1",
      "timestamp": 1402302570,
      "check": "CPU overloaded",
      "description": "CPU is above upper limit (70%)",
      "cluster": "production-databases",
      "my_unique_attribute": "myUniqueValue987654321"
   }
]

This should send an alert to BigPanda.

Uninstall the Integration

Deleting an integration requires that you remove the integration in both the integrated system and BigPanda. We recommend that you first uninstall the integration on the integrated system to prevent traffic from being sent and rejected by BigPanda, since the app key will not exist once you delete the integration in BigPanda.

Caution during replacement

When replacing an existing integration with a new tool or system, we recommend configuring the new integration first to ensure no data is lost.

Deactivate Inbound Integration

If you want to stop sending data to BigPanda but don’t want to delete your integration, you can temporarily deactivate it.

To deactivate an inbound integration:

  1. In BigPanda, navigate to the Integrations tab and select the desired integration from the list. This will open integration details on the right side of the window.

  2. At the top of the integration details, click the Active/Inactive toggle next to the application name to change the status of the integration.

In the integrations list, inactive integrations will be marked with a gray bar.

Alert resolution for inactive integrations

Any active alerts belonging to an inactive integration must be manually resolved or they will stay in the system until the auto-resolve window is reached.

Stop Sending Data to BigPanda

Within the integrated system, disable any settings that send data to BigPanda.

Each system requires specific changes to disable the integration with BigPanda. For example, you must delete the topic in CloudWatch, and you must disable the alert channel in New Relic. To determine the changes for your integrated system, reference the relevant documentation or contact BigPanda support.

Manually resolve any open alerts sent from the integration to remove the associated incidents from your incident feed. These incidents will not automatically resolve without an ok status from the original sending integration.

Delete the Integration in BigPanda

Take the following steps to delete the integration from BigPanda:

  1. In BigPanda, navigate to the Integrations tab and select the desired integration from the list.

  2. In the integration details on the right of the page, click the trash icon, then confirm you want to delete the integration. The integration will be removed immediately.

️Automatic alert resolution for deleted integrations

All active alerts from the integration will be resolved after deletion.

Data removal

This procedure does not remove any data from the integrated system.

In this section: