Skip to main content

I See (gzip) Compressed Files!

Cloudy with a chance of Cribl

This feature page was published on a previous version of the What's New with Cribl sandbox; therefore, the instructions are no longer valid.

TL;DR

You can now preview the contents of a decompressed gzip file on the Inspect File tab.

Those of us that have used Cribl Edge to inspect / monitor files on host systems have probably wished that we could see inside a compressed file without needing to go decompress it first! Well now you can. It's a small yet mighty QoL improvement. Let's go inspect a little gzip-ed text file and then move on.

View the file
  1. If not already in the Edge > Manage > default_fleet > Explore view, navigate there:
    • Ensure that the product in the top left says Edge
    • Click into default_fleet then click into the Explore subtab
  2. From the default_fleet > Explore page, click on the Files lower tab
a tale of two edge nodes

There are two Edge Nodes running in this sandbox. In order to see the intended file, we need to be inspecting on gogen-systemd-node. Please ensure we are NOT inspecting the files on whats-new-windows-node.

  1. On the top let of the Files tab, click Manual

You can probably guess, but the file we're looking for is generalKenobi.gz. Let's click on it to bring up the File modal and see the contents.

Hello there!

Now this was a simple text file that was then sent through gzip -c file.txt > generalKenobi.gz, but I like to think the outcome really show cases the concept: admins no longer need to gzip -d generalKenobi.gz > generalKenobi.txt before they can see the internal contents. Just one more reason to never leave the Cribl UI. Ever.