Replay Results

The Replay Results Dashboard shows replayed files grouped by queue_job and cribl_replay_job.

A first drilldown shows all jobs that UTStream ran against Cribl Stream to replay all files given for the selected inventory entry. It is visible in the example below how UTStream grouped the 1757 files to replay into nine jobs.

Another drill down on a job reveals each file that was part of this job. If the file was replayed and is searchable by the search head used the following additional details for the file are shown:

• Earliest timestamp for logs in the given file
• Latest timestamp for logs in the given file
• How many entries were in the given file

A final drilldown is possible on each file to the logs that were replayed from this file.