Cribl cuts Splunk spend 30-90%

Cribl is winning by selling against the tax that observability vendors charge on raw data volume. In practice, teams drop Cribl in front of Splunk, Datadog, or another log store, then use it to filter duplicates, trim low value fields, and reroute data before it is billed. That turns a budget pain point into a fast ROI purchase, which helps explain why Cribl scaled from $117M ARR in 2023 to $200M in 2024 with 145% net retention and deep Fortune 100 adoption.

• The product is concrete and easy to buy. Cribl charges about $500K a year for 5TB of daily ingest, while a customer can save about $4M a year in Splunk spend. That means the buyer is not replacing their whole monitoring stack on day one, they are cutting the bill on the stack they already have.
  1 sacra 2 sacra
• This attacks the core business model of incumbents. Splunk historically bundled ingest, indexing, and search, then charged by GB per day processed. Datadog later bought Timber Technologies and its Vector pipeline, and Splunk launched Ingest Actions, both clear signs that pre-ingest filtering became strategically important once Cribl proved customers would pay for it.
  2 sacra 4 datadoghq 5 splunk
• Cribl is also moving from toll booth to platform. After becoming the routing layer, it expanded into Edge, Search, and Lake, which lets customers keep far more telemetry in lower cost storage while preserving searchability. That widens Cribl from a savings tool into a control plane for where data goes, how long it stays, and what it costs.
  1 sacra 2 sacra 3 sacra

The next leg is straightforward. As security and observability data keeps growing, more enterprises will separate collection, routing, storage, and analysis instead of buying all four from one vendor. That shift favors Cribl, because the company sits at the decision point where every new terabyte can be filtered, redirected, or stored more cheaply before an incumbent ever gets to bill for it.