Cribl connector FAQ

Important

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Cribl from the Previews page. See Manage Azure Databricks previews.

This page answers frequently asked questions about the managed Cribl ingestion connector in Lakeflow Connect. For FAQs that apply to all managed connectors, see Managed connector FAQs.

Which tables does the connector support?

The connector supports Worker Group configuration tables (pipelines, routes, sources, destinations, parsers, breakers, grok_patterns, schemas, collectors, database_connections, packs, and functions). It also supports status tables (worker_groups, workers, health, inputs_status, and outputs_status), Organization tables (workspaces and api_credentials), and log tables (audit_log and access_log). See Destination table schemas.

How far back can the connector ingest data?

For audit_log and access_log, the first sync ingests events from the previous 365 days, or from start_datetime if you set it. Each later sync ingests events after the last run. Full-refresh tables reingest all available records on every run.

Which authentication methods does the connector support?

The connector supports OAuth machine-to-machine (M2M) authentication with a Cribl.Cloud API Credential. It does not support OAuth U2M or basic authentication.

How do I limit ingestion to specific Worker Groups?

Set the group_allowlist pipeline option to a comma-separated list of Worker Group IDs. See Connector options.