1. Pre-Migration Planning

• Create Data Inventory – Audit current on-prem environment:

  • Sources (syslog, API, collectors, etc.)

  • Destinations (SIEMs, storage, observability tools)

  • Pipelines, routes, and packs in use

  • Worker groups, nodes, and load balancers

• Identify a migration project team (Cribl admins, DevOps, networking, security, and business stakeholders).

• Document compliance, encryption, and data sovereignty requirements.

• Identify dependencies (proxies, firewalls, TLS certs, Redis/state tracking, NFS).

2. Platform Evaluation & Readiness

• Compare feature differences between on-prem and Cribl Cloud (scaling, security, observability).

• Decide deployment model: Full Cloud (Cribl Cloud managed workers) vs. Hybrid (workers on-prem, Leader in Cloud).

• Verify network connectivity requirements (firewall rules, outbound ports for workers).

• Confirm authentication/SSO integration (Local, Okta, Azure AD, etc.).

• Review monitoring/metrics strategy (e.g., forwarding Cribl internal metrics).

3. Configuration Inventory & Export

• Export routes, pipelines, packs, datasets, and knowledge objects from on-prem Cribl.

• Validate custom JavaScript functions, regex, and break logic.

• Export/review environment variables and secrets management.

• Check version alignment between on-prem and Cribl Cloud (upgrade if needed).

4. Cribl Cloud Setup

• Provision Cribl Cloud environment (Leader, workspaces, team invites).

• Configure/Bootstrap worker groups (Cloud workers and/or hybrid on-prem workers).

• Apply RBAC and team roles.

• Set up secrets and environment variables in Cloud.

5. Migration Execution

• Recreate sources, destinations, and routes in Cribl Cloud.

• Import or manually rebuild pipelines/packs.

• Validate dataset design (Lake, S3, Blob, etc.).

• Test routing logic with sample data.

• Stage migrations by source or dataset (phased approach).

6. Validation & Testing

• Validate event counts, throughput, and latency before/after migration.

• Compare output between on-prem and Cribl Cloud for accuracy.

• Confirm dashboards, alerts, and SIEM/SOAR detections still function.

• Run canary deployments (limited data sources – start small) before cutover.

7. Cutover & Decommission

• Plan cutover window and rollback procedures.

• Redirect production data sources to Cribl Cloud endpoints.

• Monitor ingestion, routing, and destination health.

• Archive old configs for rollback/reference.

8. Post-Migration Optimization

• Review and update documentation (architecture diagrams, runbooks).

• Conduct knowledge transfer with stakeholders.
  
  
  

  Professional Services Team
www.VisiCoreTech.com