Cribl grows via vendor neutral metadata reduction

Cribl won share by selling against the pricing model of the systems it fed. Large enterprises already had Splunk, Datadog, and other tools in place, but those tools charged more as log volume grew. Cribl sat in front of them, removed repetitive fields and other low value metadata, and routed the cleaned data wherever the customer wanted, turning a budget problem into an easy purchase that did not require ripping out incumbents.

• The product pitch was concrete. Cribl charged about $500K a year for 5TB of daily ingest while claiming to save about $4M a year in Splunk spend. That is why it moved from $1M ARR in 2020 to $117M in 2023 and $200M in 2024, unusually fast for infrastructure software.
  1 sacra 2 sacra 3 sacra
• Vendor neutrality mattered because Cribl did not force a platform switch. It could collect, transform, and route data to the destination of the customer’s choice. That made it useful even inside mixed estates where teams used Splunk for security, Datadog for monitoring, and S3 or Azure for cheap storage.
  1 sacra 4 datadoghq 5 cribl
• Competitors were pushed to copy the layer. Datadog bought Vector in February 2021 to add a vendor agnostic observability pipeline, and Splunk launched ingest actions for filtering, masking, and routing data before indexing. That is a sign Cribl defined a real budget control workflow, not a niche feature.
  2 sacra 6 splunk 7 datadoghq

The next phase is moving from traffic cop to system of record. Cribl Lake extends the same cost control logic into storage, so the company can capture more of the telemetry budget after first winning the routing layer. If that continues, Cribl can keep expanding from observability into security data management and take share from bundled incumbents on both ingest and storage.