Cribl

A polite middleman, sitting between every log and its destination

It is a Tuesday morning at a Fortune 100 bank, and somewhere in a data center an engineer is staring at a Splunk bill the size of a small country's defense budget. She has been here before. The numbers have gotten worse. Then she opens a browser tab, logs into Cribl Stream, and starts dragging boxes around like a sound engineer at a mixing console. Within an hour, a third of the noise has been routed to cheap object storage, the expensive stuff is going where the SOC analysts actually look for it, and the bill drops. Not by ten percent. By half.

This is what Cribl does. Not the marketing version. The actual one.

Today the company sits at the intersection of three things enterprises spend large sums to ignore: the explosion of telemetry data, the rigidity of legacy log analytics platforms, and the dawning realization that all those logs might, in fact, be a strategic asset. Cribl is the middleman who showed up to the negotiation with leverage.

Telemetry is the new tax

Every modern enterprise produces an absurd, almost cartoonish amount of telemetry. Logs from web servers. Metrics from Kubernetes pods. Traces from microservices that exist for forty milliseconds and then politely die. Security events from endpoints, network gear, identity providers, cloud control planes. In aggregate, the average large enterprise produces more telemetry data in a week than it produced in the entire decade of the 2000s.

Most of that data does nothing. It sits in expensive indexes priced by the gigabyte, waiting for a query that will never come. Some of it does everything - it catches a breach, it explains an outage, it tells you that your most reliable customer is about to churn. The problem is that nobody can tell, in advance, which bytes are which.

So enterprises did the obvious thing. They ingested everything into the most expensive tool they owned, usually Splunk, and then watched their bills climb at a rate that made CFOs reach for the smelling salts. Then, to escape, they considered switching to a different vendor. Then they discovered that switching meant rebuilding every dashboard, every alert, every parser, every saved query. Lock-in, the modern version, dressed up in a hoodie.

Three Splunkers walk into a sieve

Clint Sharp spent four years as a senior director of product management at Splunk. Ledion and Dritan Bitincka spent longer. Between them, the three founders had sat through every customer call where the conversation pivoted - inevitably, audibly - to the bill. They had heard the same complaint enough times to stop hearing it as a complaint and start hearing it as a market.

In 2018, in San Francisco, they incorporated Cribl. The name is an old English word for a sieve. The mascot is a goat. The bet was simple: if you could insert a neutral, vendor-agnostic engine between any data source and any destination, customers could keep their existing tools, drop the cost of ingestion, and finally - finally - decide for themselves what their data was worth.

The bet would have been laughable if it weren't true. Splunk, Elastic, Datadog and a dozen others had every incentive to keep the moat wide. Cribl's pitch was to fill the moat in.

Four products, one job: don't be the bottleneck

Cribl began with Stream, an observability pipeline that sits between any data source and any destination. Logs come in. Useful logs go out. Useless logs go to object storage and never get indexed at full price. Sensitive logs get redacted in flight. The whole thing runs as a graph of nodes you can wire up in a browser, which feels - and is - a lot like Photoshop for telemetry.

Then came Edge, a lightweight collector that replaces the heavy, legacy agents companies installed in the late 2000s and have been afraid to touch ever since. Then Search, which lets analysts query data where it already lives, including in S3 buckets nobody bothered to index. Then Lake, a turnkey storage system for organizations who finally accepted that they wanted to keep everything but did not want to pay enterprise SIEM rates to do it.

None of these products, individually, would have been particularly remarkable. Stitched together, they are a category. The category is called observability data management, which is a phrase analysts invented after Cribl was already winning at it.

The customers, the receipts, the math

Twenty-five percent of the Fortune 500 are paying customers. Forty-three of the Fortune 100. The list runs across banks, retailers, telcos, federal agencies, biotech firms - the unromantic backbone of large-scale IT. Cribl rarely names them, because customers of this size do not like being named, which is itself a sort of proof.

The financial story is just as telling. Cribl crossed $100 million in annual recurring revenue inside its first four years - making it, by one ranking, the fourth-fastest infrastructure company to reach centaur status. The Series E in August 2024 was led by GV in what was reportedly one of its largest-ever investments. Total capital raised now exceeds half a billion dollars.

Unlock the value of all data

The culture matches the pitch. Remote-first from day one, distributed across the US, Europe and Australia, with a goat for a mascot and a relaxed willingness to talk about money in public. Cribl employees - the company calls them Criblanians, which is a name only a remote-first company could get away with - tend to come from the customers' side of the table. They have seen the bill.

Why the next decade is even better for the middleman

The next ten years of enterprise IT are going to be defined by three things: AI workloads that produce more telemetry than any system before them, security teams under constant attack, and a regulatory environment that increasingly demands you keep records of everything. All three trends point in the same direction - more data, kept longer, queried harder, and reviewed by more people.

None of those trends are good news for vendors who price by the gigabyte. All of them are good news for the company that decides where the gigabytes go.

Cribl's next moves are obvious in retrospect, which is the cleanest signal you're building the right thing. More AI: pipelines that pre-shape data for LLM-driven analysis, which the company is already shipping. More search: federated query across more types of stores. More edge: collection from anywhere, including hardware nobody else can talk to. More lake: cheap, durable, neutral retention. The product surface grows. The pitch does not.

Back at the Fortune 100 bank, our engineer logs off for the day. The Splunk bill is no longer a crisis. The next outage will have searchable data behind it. The next breach will have months of context to investigate, instead of the seven days her old retention budget allowed. None of this is glamorous. None of it is the thing she will tell her family about at dinner. It is, however, the thing that lets the bank keep operating, and that is a kind of quiet revolution.

The middleman won. The middleman was Cribl.