Cribl cuts Splunk ingest costs

Cribl is winning by selling against the pricing model, not just the product, of observability incumbents. Splunk and Datadog make more money as customers send in more logs, while Cribl sits in front of those tools, drops low value data, reroutes useful data to cheaper destinations, and gets paid a fixed six figure subscription that can replace millions of dollars of downstream ingest spend.1 2 3 4

• The workflow is simple and concrete. Security and IT teams send raw logs from servers, apps, and cloud tools into Cribl first. Cribl filters duplicate events, strips extra metadata, and sends only the needed data into Splunk or Datadog. That is why a roughly $500K annual Cribl contract can offset about $4M of Splunk spend at 5TB per day.1 2
• This makes Cribl closer to a neutral control layer than a full monitoring suite. It began as a router in front of Splunk, then added Cribl Search, Cribl Edge, and Cribl Lake so customers can not only reduce ingest into incumbents, but also keep more data in Cribl's own lower cost storage and search stack.1 2 3
• The comparison set explains the growth. Cribl reached $200M ARR in 2024, up 71% YoY, far faster than larger public peers like Datadog and Elastic, because it is attached to budget relief. At the same time, Splunk was already a multi billion dollar ARR business inside Cisco, showing how large the spend pool is that Cribl can intercept.1 2 4 5 6

The next step is for Cribl to capture more of the stack after first proving savings at the pipeline layer. As log volumes keep rising, the company is positioned to turn a cost cutting wedge into a broader storage and search platform, which would move it from being a tool that trims incumbent spend to a system that absorbs more of it.1 2 3