Cribl Edge reference

The reference of the Cribl Edge tenant: the built-in policies and their defaults, the collection jobs, the node directory and its bounds, the System Metrics contract, the settings, bank holidays, the AI Agent, the indexed finding events, the permissions, the Configuration Guardian conditions, the REST endpoints and a troubleshooting table. The user guide is Cribl Edge; the findings model shared with Cribl Stream and User Activity Monitoring is Findings, Finding groups and findings actions.

Built-in policies

A Cribl Edge tenant has eleven built-in policies: ten Edge policies and the Leader availability policy it shares with Cribl Stream. Eight are on out of the box; Node disk, Node CPU and Node memory are off (node resource monitoring is opt-in). There are no custom policies.

Cribl Leader

Policy	What it detects	Default	Severity
Leader availability	The Leader API cannot be reached or used at a live run.	On	Critical

Fleets

Policy	What it detects	Default	Severity
Fleet connectivity	A share of the Fleet’s active nodes is disconnected.	On	High → Critical
Version drift	Connected nodes stay off the baseline version after a rollout.	On	Medium → High
Configuration drift	Connected nodes do not run the Fleet’s deployed configuration.	On	High → Critical
Fleet coverage	Fewer connected nodes than expected.	On	Medium → Critical
Node identity	Cloned nodes sharing a host name, or host names that keep changing.	On	Low
Source and Destination health	Nodes of a Fleet report a Source or Destination unhealthy.	On	Medium → Critical

Edge Nodes

Policy	What it detects	Default	Severity
Node connectivity	A selected node is disconnected or its heartbeat is too old.	On	High
Node disk	Disk used on every connected node, from its heartbeat.	Off	High → Critical
Node CPU	CPU used on a node over the last 10 minutes.	Off	Medium
Node memory	Memory used by the node’s processes over the last 10 minutes.	Off	Medium

Default settings

What each policy applies to, its checks to open and to recover (one check per published node directory, every 5 minutes), and its own settings with their defaults.

Policy	One finding per	Open / recover	Settings and notes (defaults)
Leader availability	Leader	2 / 2	Checked at every live run, for the whole tenant. No Fleet scope.
Fleet connectivity	Fleet	3 / 2	Open at 20 % of active nodes and at least 2 nodes, recover below 10 %, critical at 50 % or when no node is connected. Nodes disconnected longer than the dormancy period (7 days; 1, 7 or 30) leave the count; a Fleet with no active node reads good.
Version drift	Fleet	1 / 2	Baseline: the Leader version (or the Fleet’s most common version). Rollout grace 24 h (0–720), at least 1 node; the grace confirms. High when a node is newer than the Leader or 2 minor versions or more behind it. A node reporting no version yet is not counted.
Configuration drift	Fleet	1 / 2	Grace 30 min (0–10,080), at least 1 node, critical at 50 % of connected nodes.
Fleet coverage	Fleet	3 / 2	Expected: a configured minimum, or a learned size (the second highest daily peak of 7 days, less the allowed drop of 50 %). Reads learning until the Fleet has a peak of 2 nodes or more on two days. Critical when the Fleet has no node at all.
Node identity	Fleet	1 / 2	Host name changes in 24 hours: 3 (1–10).
Source and Destination health	Source or Destination of a Fleet	3 / 2	At least 1 node and 0 % of the nodes running it; critical at 50 % reporting trouble. A quiet Source (no traffic on any node) is skipped unless judge quiet Sources is on; a Destination is always judged.
Node connectivity	Edge Node	3 / 2	Heartbeat older than 900 s (60–86,400). Nodes come from typed host names and Splunk lookup tables; opens nothing until nodes are selected (Needs nodes). See Node connectivity selection.
Node disk	Edge Node	2 / 2	Open at 90 %, recover at 85 %, critical at 95 %. Nothing to forward.
Node CPU	Edge Node	2 / 2	Open at 90 %, recover at 80 %. Needs the System Metrics index (node_cpu_percent_active_all).
Node memory	Edge Node	2 / 2	Open at 90 %, recover at 80 %. Needs the System Metrics index (node_memory_Used_percent).

Settings every policy has. On / off; severity (Low, Medium, High, Critical; the policies above raise it in the cases listed); checks to open and checks to recover (1 to 12 consecutive directory publications, one every 5 minutes; recover 2 by default); and, except Leader availability, a Fleet scope (empty: every Fleet of the tenant) and During bank holidays (Hold new findings or Keep opening findings; see Bank holidays).

How a check works. A check is one publication of the node directory: the cohort, connectivity and disk policies judge the directory as it was published, never twice within 5 minutes. Grace starts and learned Fleet sizes are kept between runs.

How findings close by themselves. A finding recovers when the measured condition clears for the checks to recover. It closes automatically when its object is no longer listed by the Leader, when it leaves the tenant’s scope (a Fleet deselected, a node no longer selected, a policy turned off), when the tenant’s source changes (connection or Fleets), or when nothing evaluated it for 24 hours. A condition TrackMe cannot decide (unknown, for example a Fleet whose configuration target the Leader does not report) is never written as a recovery.

Bank holidays

A Cribl Edge tenant uses the bank holiday calendars of its scope, set in Manage Bank Holidays → Tenants & settings or Configure tenant → Bank Holidays: the system default calendars (bank_holidays_scope = inherit), no calendar, or the calendars it selects (bank_holidays_calendars). See Bank holidays.

Effect	On a Cribl Edge tenant
Suppress new alerts (bank_holidays_suppress_alerts, inherits the system default, on)	While a holiday of the tenant’s calendars is active, the policies set to hold open no new finding. A finding already open is still evaluated and can recover and close; a resolved or dismissed finding is not reopened by a held failure.
Exclude from ML training, exclude from SLA, monitoring windows	Do not apply (no traffic model, no entity) and cannot be set on a Cribl Edge tenant.

Per policy (During bank holidays in the policy editor):

Policy	Default
Fleet connectivity, Fleet coverage	Hold new findings
Node connectivity	Keep opening findings (it watches nodes selected as always connected)
Version drift, Configuration drift, Node identity, Source and Destination health, Node disk, Node CPU, Node memory	Keep opening findings
Leader availability	No setting (always judged)

A policy configuration saved before this setting existed reads its default. The calendars are read only while an enabled policy is set to hold. The hold is decided at the start of each check; when the calendars cannot be read nothing is held (a warning is logged). A held failure records no finding and sends no notification; the runs of the Edge Nodes and Monitoring policies jobs report the active holidays and the number of failing checks held. The drift graces (Version drift, Configuration drift) keep counting through a holiday.

Collection jobs

Each Cribl Edge tenant has three collection reports, named trackme_cribl_edge_<job>_<generation>_tenant_<tenant_id>, run as the tenant owner, and the AI Agent report (below):

Job (Collection health label)	Schedule	What it does
live (Edge Nodes)	Every 5 minutes, at a minute offset of the tenant’s own	Reads the Leader’s node list in bulk, publishes the node directory and the Fleet figures, writes the history points, then evaluates every policy (chained in the same run), drains the notification emails, the automatic assignment rules and the webhook automations, and serves the pending System activity and live status reads. Time limit 240 s.
inventory (Fleet configuration)	Every 10 minutes; a new full cycle at most hourly	Reads the Fleets and their configuration (Sources, Destinations, Pipelines, Routes, Packs). Unchanged Fleets are confirmed without being read again. Time limit 240 s.
policies (Monitoring policies)	On demand only	Evaluates the policies again on the newest directory (Run now in Collection health). Time limit 150 s.
trackme_cribl_edge_agent_tracker_tenant_<tenant_id> (AI Agent)	Hourly, when enabled	Scheduled triage by the Cribl Edge AI Agent. Off by default: the report stays unscheduled until the triage is turned on (see AI Agent).

There is no model training job. Scheduled collection off (Settings → Collection) unschedules the reports; Collect now and Run now still work. Every call to the Leader draws from the connection’s shared Leader request budget (see Cribl connections); a run that would exceed it waits and resumes at the next run.

With an expired licence, scheduled collection follows the licence enforcement ladder like the Cribl Stream tenant: it continues while the deployment is read-only and stops when the ladder stops the tenants.

The node directory and scale

How the directory is built. The live run reads the Leader’s Edge Nodes page by page and stores each node with its connection state, heartbeat, versions, configuration, OS, capacity, disk, tags, identity, and the health and last-period traffic of its Sources and Destinations. The pages add to one row per Fleet; the directory is published only once complete, so a reader never sees half of it, and a run stopped by its time limit continues at the next run. A very large directory may take several runs to build: the previous publication stays current while the build progresses.

Node state. Connected; disconnected when the Leader says so or when the node sent no heartbeat for five heartbeat periods (600 s at least); unknown otherwise. Node connectivity uses its own heartbeat limit for the selected nodes.

No limit on the number of nodes. Nothing caps the nodes of a tenant; every node is current within one live interval (no rotation, no sampling). The bounds that exist are on selections and on what one screen or record holds:

Bound	Value
Fleets per tenant	1 to 100
Edge Nodes per page of the Edge Nodes tab	100 (filters and search apply to every node)
Sources and Destinations listed per node	64 per direction (the rest counted)
Sources and Destinations kept per Fleet	100 per direction (the healthy, quietest ones leave first)
Versions listed per Fleet	20
Typed host names of Node connectivity	No count limit: the policy holds up to 384 KiB of configuration (about 15,000 names)
Lookup tables of Node connectivity	20 per policy, up to 500,000 distinct host names each (a larger lookup is refused, never truncated), read again every 15 minutes
Hosts read from the System Metrics index per policy run	120 000
Edge Nodes in one filtered Topology Studio group	20 000 (narrow the group beyond)
Edge Node entities per tenant in one Topology Studio view	100 (use groups for more)
Unresolved findings per tenant	5 000 (beyond, new failures are not recorded; Collection health says so)

History kept by TrackMe. At every publication, in the tenant’s TrackMe metric index:

• trackme.cribl.leader.edge_fleet.* per Fleet: nodes, connected, disconnected, events_in, bytes_in, events_out, bytes_out, dropped_events, version_drift_nodes, config_drift_nodes;

• trackme.cribl.leader.edge_node.* for every node: events_in, bytes_in, events_out, bytes_out, dropped_events, connected, disk_used_percent — about seven points per node every 5 minutes, roughly 2 000 per node a day.

They draw the trends of the Fleets and Edge Nodes tabs, the disk history of a node, and the Topology Studio sparklines. Traffic figures are each node’s last report to the Leader (a gauge), never volume totals.

System Metrics contract

The optional System Metrics index is a Splunk metrics index receiving the Edge System Metrics source of the tenant’s Fleets. TrackMe reads it for the Node CPU and Node memory policies and for the CPU and memory KPIs of Edge Nodes in Topology Studio, and for nothing else.

Item	Contract
Metrics read	node_cpu_percent_active_all (CPU used, every core; available in Basic mode) and node_memory_Used_percent (memory used by the node’s processes)
Node matching	The host dimension, matched to the node’s full host name, case aside (never a short-name guess). A node with no row is not measured; an open finding on it ages out.
Window	The last 10 minutes, averaged per host, at every policy run
Cost	One bounded mstats search per policy run for every node, whatever the fleet size (at most 120 000 hosts)
Without the index	Node CPU and Node memory evaluate nothing (Needs System Metrics); the CPU and memory KPIs in Topology Studio read System Metrics index not set. Everything else works the same.

The index is not part of the tenant’s source: choosing, changing or clearing it never closes findings. The System activity tab of a node does not use it either: it reads the node’s own metrics store through the Leader, on demand.

Settings reference

Setting (where)	Default	Meaning
Cribl connection (wizard; Settings → Source & Fleets)	—	The connection to the Edge Leader. Locked after creation.
Fleets (same)	Every Fleet listed at creation	1 to 100 Fleets or Subfleets. Changing them starts a new source: the findings of the previous source close.
System Metrics index (same)	None	The metrics index of the Edge System Metrics (Node CPU and Node memory). Can change at any time without starting a new source.
Scheduled collection (Settings → Collection)	On	Runs the live job every 5 minutes and the inventory about hourly.
Bank holidays (Manage Bank Holidays → Tenants & settings; Configure tenant → Bank Holidays)	The system default calendars; Suppress new alerts on	The tenant’s calendars and its one holiday effect. See Bank holidays.
Notifications (Settings → Notifications)	Off	Events opened, reopened, added to the group, escalated, recovered, dismissal ended and closed; minimum severity Medium; all policies; digest; charts on. A delivery account and recipients are required.
Assignment (Settings → Assignment)	None	Assignment groups, team email, ordered routing rules (policy, severity, Fleet, name), manual overrides. See Assignment and automatic routing.
Finding actions (Settings → Finding actions)	None	Drilldown, link and webhook actions, and the Automations that call them. See Findings actions.
AI Agent (Settings → AI Agent)	Scheduled triage off	The Cribl Edge AI Agent. See AI Agent.
Policies (Policies tab)	See Built-in policies	Saved for the tenant with their own revision, including During bank holidays.

The tenant’s indexes, roles and owner are set in the wizard and edited like any tenant’s.

AI Agent

The Cribl Edge AI Agent triages the tenant’s findings from what TrackMe holds: the finding and its Edge detail, history, episodes and Finding group; its Fleet and Edge Node in the published node directory; whether the node or Fleet is still in a current publication of the directory; Collection health; and its own past decisions. It runs no search and calls no Cribl API. The user guide is in Cribl Edge; the shared model in AI Agents for findings.

Assessments: true positive, likely false positive, expected behaviour, node or Fleet not in use, needs investigation.

Settings (Settings → AI Agent; the core ones also in Manage AI Agents automation, AI Agents automation, and in Configure tenant), stored in the tenant record:

Setting	Field	Default	Range and notes
Scheduled triage	ai_cribl_edge_agent_enabled	Off (0)	Asking the agent needs only AI to be available.
Mode	ai_cribl_edge_agent_mode	Inspect	inspect (recommend only) or act (apply allowed decisions); scheduled runs.
AI provider	ai_cribl_edge_agent_provider_name	First available	An AI provider account name.
Review interval (days)	ai_cribl_edge_agent_min_days_between_reviews	1	0 to 365; a new episode or a changed Finding group is reviewed at once.
Findings per run	ai_cribl_edge_agent_max_findings_per_run	10	1 to 50, one per Finding group, most severe first.
Time budget per run (seconds)	ai_cribl_edge_agent_max_runtime_sec	3 000	60 to 86 400.
Custom instructions	ai_cribl_edge_agent_custom_instructions	Empty	At most 4 000 characters, line breaks kept; followed by every run, asked or scheduled; never widen what the agent may do.
Allow Mark investigating	ai_cribl_edge_agent_allow_investigating	Allowed (1)	An open finding only.
Allow Dismiss for a time	ai_cribl_edge_agent_allow_dismiss_temporary	Allowed (1)	A critical or high finding still failing only when its node or Fleet is gone from the node directory; never across the nodes of a Finding group.
Longest dismissal (days)	ai_cribl_edge_agent_dismiss_max_days	7	1 to 90.
Allow Resolve	ai_cribl_edge_agent_allow_resolve	Not allowed (0)	Only after a measured recovery, and not while a member of its Finding group fails.

The shared filters of the automated AI reviews, ai_automated_priority_filter (by default critical and high findings) and ai_automated_filter_expression, apply to the scheduled selection with the finding severity as the priority. There is no Not an anomaly and no Stop monitoring decision on Edge. The agent never dismisses permanently, assigns, changes a severity, a policy, the node selection of Node connectivity or the collected Fleets.

Gone from the node directory. True only when a current publication of the directory no longer lists the node or the Fleet (or the Fleet is no longer selected), and the finding has not been evaluated for an hour. Unknown when the directory is not published or not current; never decided for the Leader availability finding. A Source or Destination finding is judged gone only with its Fleet.

Scheduled triage runs the report trackme_cribl_edge_agent_tracker_tenant_<tenant_id> hourly, at a minute of the tenant’s own, when all of these hold: the AI Assistant is enabled, an AI provider is configured, the tenant is enabled, and scheduled triage is on. The report runs as the tenant owner, which must be a Splunk administrator account (admin or sc_admin), not nobody. Saving the settings schedules or unschedules it at once, and the tenant health tracker checks the same conditions every five minutes. A scheduled run never decides on a finding or Finding group an operator decided on or assigned.

Evaluate runs the agent in inspect mode on an unsaved draft of the custom instructions (one open finding, or a review of at most 10 open findings), optionally next to a run without instructions. It writes no note, no decision and no review record, and is indexed with the status evaluation.

Audit. Every run is indexed to the tenant summary index with the sourcetype trackme:ai_agent:cribl_edge_agent:inspect or trackme:ai_agent:cribl_edge_agent:act, with launched_by (UI, AI Assistant or automation) and automated; the audit dashboards label it Cribl Edge AI Agent. Decisions appear in the finding’s history under the actor AI Agent, and the reviewed finding carries one current [AI Agent] note.

index=trackme_summary sourcetype="trackme:ai_agent:cribl_edge_agent:*" tenant_id="edge-example"
| table _time, sourcetype, launched_by, automated, status

Indexed finding events

Every transition of a finding and of a Finding group is written as an event, whatever the notification settings:

Item	Value
Index	The tenant’s notable index (trackme_notable by default)
Sourcetypes	trackme:cribl:finding (a finding) and trackme:cribl:finding_group (a Finding group)
object_category	cribl_edge (indexed, with tenant_id)
Transitions	opened, reopened, recovered, closed, resolved, dismissed, dismissal ended, investigating, assigned / unassigned, snoozed / unsnoozed, escalated, severity changed; groups add member added and members changed
Key fields	finding_id, transition, transition_label, transition_id (deduplicate on it), policy_id, policy_name, severity, display_severity, status, condition, reason, group_id, worker_group (the Fleet), entity_name, value, unit, assignee, actor

Example: the Edge findings opened or reopened in the last day.

index=trackme_notable sourcetype=trackme:cribl:finding object_category=cribl_edge tenant_id="edge-example"
    transition IN ("opened", "reopened")
| table _time, policy_name, worker_group, entity_name, severity, reason, finding_id

Permissions

Each tier needs the TrackMe capability and one of the tenant’s matching roles; a Splunk administrator (admin, sc_admin) holds every tier on every tenant.

Action	Who
Read every tab; ask for a node’s System activity or a Source / Destination live status; run drilldown and link actions	Any role of the tenant (trackmeuseroperations)
Triage findings and Finding groups (investigate, assign, snooze, dismiss, resolve, change the severity, group by hand), notes; send a webhook action; ask the AI Agent and let it act on its inspection	The tenant’s power and admin roles (trackmepoweroperations)
Policies (on / off, severity, conditions, scope, during bank holidays)	A TrackMe administrator of the tenant (trackmeadminoperations and a tenant admin role)
Source & Fleets, Collection, Collect now / Run now, Repair workspace, Notifications, AI Agent settings, Assignment settings, Finding actions and Automations	A TrackMe administrator of the tenant
Create or delete the tenant; manage Cribl connections and Webhook accounts	TrackMe administrators; Cribl connections: Splunk administrators (see Cribl connections and Webhook accounts)

A System activity read asked by a TrackMe administrator of the tenant starts at once; any other role’s read is served by the next live run.

The tenant’s bank holiday calendars and effect are set on the Bank Holidays page like for every tenant (Bank holidays). The scheduled AI Agent needs a tenant owner that is a Splunk administrator account (not nobody). Turning the AI Agent on, act mode, allowing a decision, a longer dismissal or custom instructions need a licence that allows changes; restricting the agent never does.

Node connectivity selection

Node connectivity watches the nodes that must stay connected, from two sources that add up:

Source	Rules
Typed host names	One per line (spaces and commas also separate), case-insensitive. * stands for any text (dc-* selects dc-01.example.com); * alone is refused. No count limit: the policy holds up to 384 KiB of configuration, about 15,000 names.
Splunk lookup tables	Up to 20 per policy, each a CSV or KV store lookup shared with the TrackMe app, on the local search tier or on a remote deployment through a TrackMe remote account, with the field holding the host names. Up to 500,000 distinct host names per lookup; a larger one is refused, never truncated. Multivalue fields give one name per value; values that cannot be a host name are counted as ignored.
Match mode (per lookup)	Exact (default): whole host names, case-insensitive; a value holding * is ignored. Wildcard: * matches any text; the editor warns about the cost of patterns with * at both ends. A lookup saved without a mode reads Exact.

Refresh. The policies run reads each lookup again every 15 minutes, the oldest first, and keeps its host names between reads. A lookup that cannot be read keeps its last good host names, so an outage of a remote search tier never deselects nodes; a lookup never read successfully selects nothing. Collection health reports node_lookups_failing when a lookup is unreadable, too large or empty.

Test selection runs as a search: it reads every lookup now (no cached names) and the latest Edge Nodes directory, then shows how many nodes the names select by state (connected, disconnected, unknown) inside and outside the policy’s Fleet scope, each source with its status and its names matching or ignored, up to 50 selected nodes (disconnected first) with what matched them, and the names that select no node. It saves nothing. Policy managers of the tenant use it, like the rest of the editor.

Host names are selectors: they are not copied into the evidence of the findings.

Configuration Guardian

The tenant check cribl_collection_health raises Cribl Edge collection needs attention (warning) when collection does not run as configured, and clears by itself on the first run without a problem. The Collection health tab shows the same conditions.

Condition	In plain words
edge_node_metrics_missing	Half or more of the connected Edge Nodes report no metric to the Leader: their Sources, Destinations and traffic are not measured. Check the nodes’ metrics settings in Cribl Edge, then Collect now.
system_metrics_not_arriving	No Edge System Metrics (node_*) reached the System Metrics index in the last 10 minutes: Node CPU and Node memory evaluate nothing. Check that the Fleets’ System Metrics source is on and routed to that index, with the node host name as host.
system_metrics_unreadable	The System Metrics index could not be searched, or holds more hosts than one run reads.
node_lookups_failing	A lookup table of Node connectivity could not be read, holds more than 500,000 host names, or is empty, at the last policies run. A lookup that cannot be read keeps its last host names (no node is deselected); one never read selects nothing. Check the lookup, its sharing with the TrackMe app, and the remote account when it is on a remote deployment.
live_never_ran, live_not_running	No Edge Nodes run since the source was configured, or none for 20 minutes. Check that the reports exist, are scheduled and that their owner can run searches.
live_failing, policies_failing, inventory_failing	A job keeps failing (30 minutes for live and policies, 90 minutes for the inventory: never on a single failed run).
inventory_never_ran, inventory_not_running, inventory_not_published, inventory_cycle_slow	The Fleet configuration is not read, or its cycle takes more than a day at the Leader’s request budget.
worker_directory_stale	The Edge Nodes directory is not refreshed: connections and versions are out of date. The Edge policies stop rather than judge an old directory.
capacity_reached	A capacity limit was reached (for example more than 5 000 unresolved findings).
notification_delivery_failing	Notifications are on and the emails have failed for 30 minutes. Collection never waits for delivery.

Each alert carries its recommended actions. See Configuration Guardian.

Also relevant: ai_automation_owner_is_system_user warns when the AI Agent’s scheduled triage is on and the tenant owner is nobody or a system account, so the scheduled runs cannot start.

REST endpoints

The workspace uses the /trackme/v2/cribl/tenant/* endpoints shared with Cribl Stream (workspace, configure, collect, collect_result, repair, policies, findings, finding, triage, finding_groups, group_triage, group_members, notifications, notification_test) plus the Edge reads below, which answer cribl_edge_tenant_required on a Cribl Stream tenant. Every endpoint documents itself with describe=true and is listed in the REST API Reference page.

Endpoint	Purpose
GET edge_overview	Directory head, summary and the Fleet rows
GET edge_fleet	One Fleet (group_id): figures, Sources and Destinations, example nodes
GET edge_nodes	A page of nodes (up to 100), filters group_id, state, version, config_state, platform, io, q
GET edge_node	One node (worker_id) in full
GET / POST edge_node_machine	Read the latest System activity of a node over a range (15m, 1h, 4h, 12h) / ask for one
GET / POST edge_io_status	Read / ask for the live status of a Source or Destination on a node

The AI Agent uses the cribl/tenant operations shared with the Cribl Stream AI Agent, which serve the agent of the tenant’s product: agent_settings (GET; POST saves them), agent_findings, agent_evidence, agent_decisions (reads), agent_decide and agent_review (writes of a run). Runs are started, followed and cancelled through ai_findings_agent/agent (mode inspect or act, an optional finding_id; evaluate_instructions for an evaluation), ai_findings_agent/agent_status and ai_findings_agent/agent_cancel.

Example:

| trackme url="/services/trackme/v2/cribl/tenant/workspace" mode="get" body="{\"tenant_id\":\"edge-example\"}"

Troubleshooting

Symptom	What to check
The wizard cannot list the Fleets	The message names the cause: credentials refused, no right to read Cribl Edge, Leader unreachable, certificate not trusted (add the CA chain to the connection), Leader busy (retry). Test the connection in Manage Cribl connections.
“This connection lists no Edge Fleet”	The connection points at a workspace without Edge, or its API client cannot read Cribl Edge.
The workspace shows no Fleet or node	The first live run has not completed: Collect now, then Collection health.
A selected Fleet shows “No longer listed”	The Fleet was removed or renamed on the Leader: clear it in Settings → Source & Fleets and save.
Nodes show No metrics	Their Leader record carries no metric: their Sources, Destinations and traffic are not measured. Check their metrics settings in Cribl Edge.
A disconnected node opened no finding	Expected: Fleet connectivity judges shares (20 % and 2 nodes by default). Add the node’s host name to Node connectivity for nodes that must never drop.
Node connectivity shows Needs nodes	Add host names or a lookup table in its editor: until then it opens nothing. Use Test selection to check which nodes they select.
Collection health: node_lookups_failing	See the Configuration Guardian table above. A lookup that cannot be read keeps its last host names, so no node is deselected meanwhile.
Node CPU / Node memory show Needs System Metrics, or find nothing	Set the System Metrics index; check system_metrics_not_arriving in Collection health, the metric names and that host is the node’s full host name.
System activity shows only current figures, without charts	The node’s System Metrics source is off in its Fleet: turn it on in Cribl Edge.
System activity says the node cannot be read	The node is disconnected, or the Leader request budget is exhausted for now: the next live run tries again.
Version drift opened while nodes are upgrading	The rollout grace (24 h by default) has passed. Raise it, or compare with the Fleet’s most common version.
Fleet coverage reads learning	It needs daily peaks of 2 nodes or more on two days, or a configured Expected connected nodes.
Findings closed after changing the Fleets	Expected: a change of Fleets (or of connection) starts a new source.
Collection health: edge_node_metrics_missing	See the Configuration Guardian table above.
Fleet connectivity or Fleet coverage opened no finding during a holiday	Expected: they hold new findings on the bank holidays of the tenant’s calendars by default. Choose Keep opening findings in the policy editor, or change the tenant’s calendars.
The scheduled AI Agent does not run	AI Assistant disabled, no AI provider, scheduled triage off, the tenant disabled, or a nobody tenant owner. The AI Agent tab says which; give the tenant a Splunk administrator owner when needed.
The AI Agent did not dismiss a critical finding it judged expected	Expected: a critical or high finding still failing is dismissed only when its node or Fleet is gone from a current node directory, and never across the nodes of a Finding group. Decide it yourself, or let it recover.
A run failed and the reason is unclear	The collector log, index=_internal sourcetype=trackme:custom_commands:trackmecriblcollect (file trackme_cribl_collect.log): one summary line per run, a WARNING for an external failure (the Leader, its network, the Splunk tier), an ERROR for an internal TrackMe failure.