Cribl Controls Ingest Costs

Cribl wins by breaking the old rule that the system storing data must also control how that data gets filtered and routed. Large enterprises often run Splunk, Datadog, cloud tools, and security products at the same time, so a neutral layer that sits in front of all of them lets teams drop low value logs, redact fields, and send each stream to the cheapest or most useful destination. That turns exploding data volume from a platform tax into something customers can actively manage.1 2 3 4 5

• The savings are concrete, not theoretical. Cribl’s core pitch has been trimming unnecessary metadata before ingest into tools like Splunk, with pricing around $500K a year for 5TB of daily ingest while saving a customer roughly $4M a year in Splunk spend. That cost delta is why Cribl expanded from $117M ARR in 2023 to $200M ARR in 2024.1 2 3
• Vendor neutral matters because enterprises rarely standardize on one telemetry stack. Datadog bought Vector, a vendor agnostic pipeline, and Splunk built Ingest Actions to route, filter, and mask data before indexing. Both moves validate that control over data before it lands in a paid store has become a strategic layer.2 4 5 6
• Cribl is using that neutral control point to move beyond routing into storage and security workflows. Cribl Lake gives customers a lower cost place to keep petabytes of telemetry, and partnerships with Wiz and other security platforms make Cribl a switchboard that can feed multiple downstream tools instead of locking the buyer into one vendor’s stack.2 3 7

The next step is for data pipelines to become the budget control plane for observability and security. As data keeps compounding and more vendors charge by ingest or retention, the company that decides what gets kept, dropped, or rerouted will capture more spend. Cribl is pushing from a savings tool into that central operating layer.2 3 4 7