Cribl
Cribl routes, filters, and shrinks log and security data before it hits storage tools.
On the record
Checkpoint: Federal Circuit ruling on Splunk's appeal over S2S interoperability (docket 26-1317/26-1355)
The call
Cribl sits between data sources and the tools that charge for ingesting them, a position its biggest rivals are financially discouraged from copying.
Cribl is a software company that sits between where data is created and where it is stored or analyzed. It lets companies pick and choose which data to send where, cutting waste and cost. The big companies that store data like Splunk, Datadog, and Elastic make money when customers send them lots of data, so they cannot afford to sell a tool that sends them less data without hurting their own profits. Cribl has also built deep connections to many data sources that would take years to copy, and courts have said these are fair game. The one thing that could change the picture is if Snowflake or Databricks, two giant data companies that recently bought smaller rivals, decide to build their own data-sending tool as part of what they already sell, which they have not done yet.
Why
01
AI pressure: None apparent. AI agents multiply log and query volume 10 to 100x, so AI expansion feeds Cribl's pipe rather than eating it. Could AI do the core job? Unlikely.
02
Bigger players: Snowflake (via Observe acquisition) and Databricks (via Panther Labs acquisition). Both are lakehouse giants that could bundle a first-party ingestion pipe instead of consuming Cribl's, but neither has shipped that yet. Could a giant copy it? No, they are blocked.
03
What protects it. Splunk, Datadog, and Elastic profit from data volume, so they cannot ship a 'send less data' product without cutting their own revenue.
What would change this call
Snowflake (Observe) or Databricks (Panther Labs) ships a bundled first-party ingestion pipe inside its lakehouse. Would create a head-on rival not blocked by ingest-volume pricing conflicts.
Federal Circuit rules on Splunk's cross-appeal (docket 26-1317/26-1355) on S2S interoperability. An injunction would restrict one of Cribl's key integrations with Splunk.
Cribl's cloud ARR growth rate in upcoming quarterly disclosures versus prior ~75% YoY pace. A stall would support the claim that platform giants are absorbing pipeline demand.
Federal Circuit rules on Splunk's cross-appeal (docket 26-1317/26-1355) on S2S interoperability. An injunction would restrict one of Cribl's key integrations with Splunk.
Cribl's cloud ARR growth rate in upcoming quarterly disclosures versus prior ~75% YoY pace. A stall would support the claim that platform giants are absorbing pipeline demand.
Key numbers
- $300M+ ARR, cloud ARR over $130M, up 75% YoY
- ~1,400 customers, 50% of Fortune 100
- 1,239 employees, up 16% YoY, traffic down 6% QoQ
Named risks
- Federal Circuit could reverse Splunk verdict and grant injunction on S2S interop.
- CardinalOps integration (announced July 14, 2026, unclosed) could strain SIEM partnerships.
- Snowflake or Databricks could bundle a first-party ingestion pipe into their lakehouse.
- Growth could decelerate materially without confirmed profitability progress.
- Profitability status remains unconfirmed since 2024 stated 2025 goal.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Splunk | contesting | $1 damages verdict upheld Dec 2025 in Splunk's suit over Cribl's S2S interop; appeal pending |
| Snowflake | gaining on | Acquired observability startup Observe (Jan 2026), a potential lakehouse ingestion threat |
| Databricks | gaining on | Acquired Panther Labs (June 2026), adding security-analytics capability adjacent to Cribl |
| Edge Delta | contesting | Markets built-in AI automation against Cribl's manually-tuned, script-based pipelines |
| Datadog | contesting | Maintains open-source Vector as a free alternative to Cribl's paid pipeline tooling |
Questions people ask
- Is Cribl profitable in 2026?
- Unconfirmed. As of the August 2024 Series E, Cribl was not cash-flow positive and had stated a goal of reaching profitability in 2025; no independent source has confirmed that goal was met as of July 2026.
- Who owns Cribl?
- Cribl is privately held and venture-backed with no parent company. Its Series E closed August 27, 2024 for $319M led by GV (Google Ventures), valuing the company at $3.5B with over $600M raised total.
- Could AI replace Cribl?
- Unlikely soon. Cribl's own data (March 10, 2026) says AI agents generate 10-100x more telemetry queries than humans, feeding its pipeline business, while it has embedded agentic search and custom OpenAI/Anthropic model support rather than being displaced.
- Is Cribl a safe company to join in 2026?
- Cribl surpassed $300M ARR (announced February 11, 2026) with 70%+ YoY growth and passed 1,000 employees in January 2026, though Crustdata's July 2026 tracker called headcount growth 'modest' and noted web traffic down 6% quarter over quarter.
- Who is Cribl's biggest competitor?
- Splunk (Cisco-owned) is Cribl's most direct legal adversary, having sued over its S2S protocol interop; a federal jury awarded Splunk only $1 in damages, upheld December 2025, with appeal pending. Snowflake and Databricks are emerging platform-level threats via 2026 acquisitions.
- Did Cribl win its lawsuit against Splunk?
- Largely yes. A federal jury (April 2024) found Cribl liable but awarded Splunk just $1 in damages; courts also validated Cribl's reverse-engineered Splunk S2S protocol as fair use (April 23, 2024). The trial judge upheld the verdict in December 2025, with an appeal pending.
Timeline
- 2026-07-14Cribl announces first acquisition, CardinalOps, adding ~200 engineers and Tel Aviv office
- 2026-07-08Crustdata tracker records 1,239 employees, +16% YoY, web traffic down 6% QoQ
- 2026-06-30Databricks acquires security-analytics company Panther Labs
- 2026-05-21Cribl Stream integrates with Anthropic's Claude Compliance API
- 2026-03-11Cribl unveils agentic AI enhancements to Cribl Search
- 2026-02-11Cribl announces it surpassed $300M ARR, cloud ARR over $130M growing 75% YoY
- 2026-01-31Cribl achieves FedRAMP Authority to Operate, enabling federal sales
- 2026-01Snowflake acquires observability startup Observe
- 2025-12-31Trial judge upholds $1 damages verdict in Splunk v. Cribl; both sides appeal
- 2025-01-22Cribl surpasses $200M ARR, +70% YoY, NDR above 130%
- 2024-08-27Cribl closes $319M Series E at $3.5B valuation, led by GV
- 2024-04-23Court rules Cribl's reverse-engineered Splunk S2S protocol is fair use
Revision history
21 July 2026
First assessed. Hard to displace. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Cribl.io
- Cribl Surpasses $100M in Annual Recurring Revenue in Less Than Four Years
- Cribl Surpasses $200M in ARR, Growing More Than 70 Percent Year-over-Year (2025-01-22)
- Cribl Surpasses 300 million in ARR, Powering the Essential Infrastructure for the AI Era (2026-02-11)
- About Cribl (2026-03-25)
- TechCrunch: Data infrastructure startup Cribl raises $319M at a $3.5B valuation (2024-08-27)
- Employee Count & Headcount Data (2026-06-29)
- Cribl Surpasses 300 Million in ARR, Powering the Essential Infrastructure for the AI Era (2026-02-11)
- Crustdata: Cribl (2026-07-08)
- Forge Global: Cribl IPO
- Cribl Unveils Agentic AI Enhancements to Cribl Search (2026-03-11)
- Cribl Search 4.19.0 Release Notes