Skip to main content
Where the Mac-side OS telemetry pack lives, how it gets onto the host, and which Splunk indexes it populates. Pack internals — Sources, predicates, override patterns, version-to-version changelogs — live in the repo’s own README.
This page is the homelab-integration view of cc-edge-the-mac-pack-io. It covers where the pack runs, what it sends, and how it slots into the wider observability stack. For the full Cribl-side reference — every Source, every input, anomaly-detection rules, override patterns, release notes — read the repo’s README.

​
Where it runs

The pack targets a native macOS Cribl Edge install, managed declaratively by nix-darwin. Three install constraints from this homelab’s posture:
  • The Edge install must be native to the Mac — exec inputs in the pack invoke macOS-only binaries (pmset, ioreg, powermetrics) and will not work from a Linux container.
  • The Mac runs Cribl Edge directly, not through OrbStack — the K8s cluster runs unrelated Cribl Edge instances for different workloads, and this pack does not target them.
  • Each Mac’s Edge runs standalone — no Cribl Leader manages it, and enrolling Macs into a Cloud-managed fleet is explicitly forbidden in this posture. Configuration is GitOps: the pack version is pinned in the nix-darwin host config, and updates land by bumping the pin and rebuilding — never by a Leader or Cloud push.

​
What it sends

Data lands in two Splunk indexes: Per-use-case filtering — security event extraction, performance triage, alerting rules — lives in Cribl Stream pipelines downstream of this Edge install, not in the pack itself.

​
Install

A new Mac joins the telemetry fleet by:
  1. Bringing up the standalone Cribl Edge install via nix-darwin (handled by the macOS host config — not Mintlify’s concern).
  2. The same nix-darwin activation installs the pinned pack version from the repo’s release artifact. No Leader, no heartbeat push, no per-host install command — the host config is the whole deployment.
Upgrades are GitOps: bump the pinned pack version in the nix-darwin config, rebuild, done. For one-off testing outside the Nix-managed path, the pack ships a .crbl artifact installable via Cribl’s REST API; see the repo README for that path.

orbstack-kubernetes

The K8s cluster — runs unrelated Cribl Edge instances. This pack does not target that cluster.

Monitoring agents

Cross-stack view of every collector and where it runs.

Source on GitHub

The pack itself: every Source, every input, anomaly-detection rules, override patterns, release notes.