Cribl Exploits Usage-Based Pricing
Cribl
Cribl wins by making data volume itself negotiable, which turns the core revenue engine of Splunk, Datadog, and parts of Elastic into a customer pain point. In practice, these platforms often charge on data ingested, indexed, stored, or scanned, so every new app, server, and security tool can raise the bill. Cribl sits in front of them, drops low value logs, reroutes copies to cheaper storage, and lets teams keep key alerts and searches while cutting spend by 30% to 90%.
-
Splunk is the clearest example. Its ingest pricing is based on GB per day, and its own guidance frames high volume, low value data as a license cost problem. Cribl was built by former Splunk employees to filter that data before it reaches Splunk, with a common pitch of roughly $500K a year to avoid about $4M of downstream spend.
-
Datadog has the same structural exposure across logs and pipelines. Datadog lists charges per ingested GB for logs, APM ingestion, and Observability Pipelines, which is why it bought Timber Technologies and brought Vector into the stack. But Vector mainly helps customers onboard and route data into Datadog, while Cribl is positioned as a broader neutral control layer across multiple destinations.
-
Elastic is more flexible, but it is still tied to data growth. Its serverless observability pricing includes ingest and retention meters, even though Elastic also emphasizes resource based pricing more broadly. That still gives Cribl room to intercept noisy telemetry before it lands, especially for enterprises trying to separate expensive hot data from cheap long term storage.
The next step is from saving money on incumbent tools to becoming the default traffic controller and archive for machine data. As telemetry keeps growing around 28% annually and Cribl adds Lake, Edge, and Search, more budget will move toward the layer that decides what data is worth paying premium observability prices for in the first place.