Jan-Erik Asplund
TL;DR: Sacra estimates that Cribl hit $120M ARR in 2023, up 100% year-over-year, with their data pipeline product that is disrupting Splunk by counter-positioning against their cash cow business and saving customers 30-90% on their bills. For more, check out our report and dataset on Cribl.
Key points from our research:
- In 2003, Splunk (NASDAQ: SPLK) launched as the Google for machine data, ingesting and making searchable the terabytes of logs from the average enterprise’s 25-40 sources of IT data, from web and email servers to databases. By bundling together the ingestion, indexing, and analysis of the exponentially growing amount of machine data being generated—and charging on usage via GB/day processed—Splunk hit $100M ARR in 11 years.
- Ex-Splunkers Clint Sharp, Dritan Bitincka and Ledion Bitincka left and founded Cribl in 2018 to help Splunk customers save 30-90% on their Splunk bills by trimming unnecessary metadata from log data before sending it into Splunk, charging ~$500K/yr for 5TB of daily data ingest to save customers $4M/yr in Splunk. Splunk sued Cribl for IP theft, claiming that they strategically sold into Splunk’s biggest customers by revenue—their jury trial started this week, with William Alsup (judge in Waymo’s lawsuit against Uber over its acquisition of self-driving startup Otto) presiding.
- Sacra estimates that Cribl hit $120M annually recurring revenue (ARR) at the end of 2023, up 100% year-over-year, for a 21x forward revenue multiple on their $2.5B valuation (2022)—they grew from $1M to $100M faster than other infrastructure companies like Datadog, MongoDB and Twilio, with 145% net retention. Compare to Datadog (NASDAQ: DDOG) at $2.4B ARR, up 26%, for a 18x multiple and $42B market cap, Elastic (NYSE: ESTC) at $1.3B ARR, up 19%, for a 7.6x multiple and $10B market cap, and Splunk (NYSE: CSCO) at $4.2B ARR, up 15%, for a 6.6x multiple and $28B acquisition by Cisco.
- Like Ramp did in corporate cards, Cribl has attacked and counter-positioned against incumbents’ cash cow business model of usage based on data volume, with the explicit value prop of saving you money on SaaS spend across security information and event management (SIEM) like Splunk, and application performance monitoring (APM) like Datadog and New Relic and threat detection, investigation and response (TDIR) companies like Exabeam. Datadog and Splunk have been forced to respond, acquiring and bolting on their own vendor-agnostic data pipeline product Vector.dev and launching Splunk Ingest Actions, respectively, to filter out unnecessary data pre-ingest.
- That’s made Cribl a core data router a la Segment (NYSE: TWLO, $295M revenue in 2023) whose move now is to vertically integrate backwards into building their own private label source/destination apps to compete with its own integration partners like New Relic via Cribl AppScope (2021), Splunk via Cribl Search (2022), and Edge Delta via Cribl Edge (2022). The upside is driving expansion and average revenue per customer (ARPC) while making the data router stickier, plus 10x’ing their TAM from the $2B observability market to include SIEM ($10B) and APM ($10B).
For more, check out our report and dataset on Cribl, as well as this other research from our platform:
- Fivetran (dataset)
- Databricks (dataset)
- Fivetran: the $200M/yr Zapier of ETL
- Salesforce, Amplitude, and the fat data layer in B2B SaaS
- Colin Nederkoorn, founder & CEO at Customer.io, on the CDP layer in messaging
- Geoff Charles, VP of Product at Ramp, on Ramp's AI flywheel
- Conor McCarter, co-founder of Prequel, on Fivetran's existential risk
- Julia Schottenstein, Product Manager at dbt Labs, on the business model of open source
- Sean Lynch, co-founder of Census, on reverse ETL's role in the modern data stack
Read more from
Read more from
How Clearbit sold to HubSpot
Free Report
Continue Reading
Instabase: the $70M/year Palantir of banking
Unlocked Report
Continue Reading
Instabase revenue, growth, and valuation
Unlocked Report
Continue Reading
