Cribl Deployment Health Check

Cribl environments drift. Pipelines accumulate functions nobody remembers adding, routes overlap, worker groups outgrow their sizing, and the version that was current at deployment is two releases behind. None of it breaks loudly. It shows up as cost, latency and the occasional dropped event.

A health check is the cheapest way to find those issues before they become an incident. One environment, ten review areas, one report your team can act on.

• Confidence that the deployment runs efficiently, with fewer surprises at peak
• Expert guidance on the core features you are and are not using
• Best-practice recommendations for your observability pipeline, specific to your configuration
• A prioritized, actionable report your team can work through on its own

Service

Cribl Deployment Health Check

Part number

VC-PS-HC-CRIBL

Platforms

Cribl

Engagement

Fixed-scope project, 90 days service period

Pricing

Stated on the Order Form. Request a quote.

The Cribl Deployment Health Check is a fixed-scope remote review of a single Cribl Stream or Cribl Edge environment. It evaluates the health and efficiency of the deployment, reviews how the components interact, examines data flows for bottlenecks and errors, and analyzes performance metrics against Cribl best practices.

The outcome is a detailed, prioritized health report. The check identifies common errors and bad practices in pipeline and routing configuration, and recommends changes to improve stability, performance and cost. It does not change anything in your environment.

VisiCore delivers this service remotely through scheduled working sessions led by a named VisiCore engineer who holds current Cribl and/or Splunk certifications. On-site days can be added under a separate order.

Unless agreed otherwise in writing, the engagement starts within one week of VisiCore accepting the signed order. The working schedule is set at the kickoff meeting.

VisiCore provides an agenda before each session, including which of your team members should attend. Sessions run one to four hours.

Every task, decision and deliverable is tracked as a ticket in the X10 client portal, so your team always has a current record of what was done and why.

Scope summary. The base scope below, delivered in approximately 4 working sessions.

• One environment: production, staging or development, chosen at kickoff. Recommendations apply to that environment only
• Review area 1: system architecture and component interaction
• Review area 2: ingest and egress capacity against current and planned volume
• Review area 3: source configuration
• Review area 4: destination configuration
• Review area 5: data routing optimization, including overlapping and unreachable routes
• Review area 6: pipeline configuration, function usage and common anti-patterns
• Review area 7: logging and errors across Leader and Workers
• Review area 8: version and feature currency, including features available but unused
• Review area 9: networking configuration between Leader, Workers, sources and destinations
• Review area 10: performance metrics, including CPU, memory, backpressure and persistent queue behaviour
• Written health report with findings ranked by impact and effort, delivered in a walkthrough session

Quantities

Deliverables

• Health report covering all ten review areas, with each finding ranked by impact and effort
• Recommended fix for every finding, with a note on whether your team or VisiCore should do it
• Summary of features available in your version that you are not using and would benefit from
• Report walkthrough session recording and notes in the X10 portal

Planning schedule for a typical engagement. The actual schedule is agreed at kickoff; hours are estimates of effort per session, not a guaranteed number of service hours.

VisiCore Technology Group provides the services described in this brief under the applicable Order Form and the VisiCore Master Services Agreement, or another written agreement in place between VisiCore and the customer.

Session and hour counts in this brief are planning estimates for the work described, not a guarantee of a fixed number of service hours.

Pricing is stated on the Order Form. Contact VisiCore for a quote.

The following are not included unless added to the Order Form:

• Installation, modification or maintenance of customer hardware, operating systems, containers, firewalls or load balancers
• Changes to the configuration of source or destination systems outside the platform in scope
• Backup and recovery, or day-to-day maintenance, of the customer's environment
• Performance testing and benchmarking
• Formal product training beyond the guidance given in working sessions
• Any service or activity not explicitly listed in the Scope section of this brief
• Fixing the issues identified in the report (see Resident Engineer or a custom SOW)
• Full pipeline optimization or performance tuning. Recommendations focus on stability and best practice
• Environments other than the one selected at kickoff
• Installing, modifying or maintaining Cribl products during the review

90 days.

• The customer has 90 days from the start date (the "Service Period") to schedule and use the services in this brief.
• The service ends automatically at the close of the Service Period unless VisiCore agrees in writing to extend it.
• Unused portions of the service are non-refundable and non-creditable.
• VisiCore may deliver services after the Service Period if the customer gives written notice at least 30 days before it ends and VisiCore agrees.

To deliver this service on schedule, the customer agrees to:

• Name an engagement lead with the authority to make decisions and accept deliverables
• Provide the accounts, access and network connectivity VisiCore engineers need before the first working session
• Attend scheduled sessions (one to four hours each) and complete prerequisite work before them
• Bring the subject-matter experts who own the systems being integrated
• Review each deliverable within five business days of hand-off. Without written feedback in that window the deliverable is accepted; non-blocking issues are handled after acceptance
• Provide reasonable access to the Cribl Leader and Worker UI and logs, and engagement with the teams who operate them
• Provide a Cribl diag bundle from the Leader node when requested
• The health report is accepted when the customer confirms it in writing, or five business days after delivery if no critical defects are reported in that window

Meetings are scheduled at mutually agreed times during VisiCore business hours.

The customer must give at least 48 hours' written notice to cancel, reschedule or shorten a scheduled meeting. Without that notice, VisiCore may count the meeting as delivered.