Yesterday, Splunk announced legal action against Cribl. As a former Splunk customer and employee, this news makes me sad. Splunk now enters the realm of incumbents who litigate rather than innovate. These claims are baseless, and unsurprisingly I have a few things to say. The core of Splunk’s intellectual property claims stem from accusing me personally of stealing IP from Splunk in order to create Cribl. These claims are baseless as I’ll establish in this blog.

While interoperability with Splunk has been a key feature in our product, the value of providing a pipeline which can route data anywhere while controlling costs has clearly resonated with the market. Cribl is one of the fastest growing companies in enterprise software for a reason. Our “customers first” approach to innovation is resonating. We started Cribl in June 2018, 15 mos after we’d left Splunk, after discovering customers were struggling to tame the growth in data. Data is growing at 25% CAGR, meaning you’ll have 250% more data in 5 yrs than you have today. What worked for the last decade won’t work today.

Our core innovation, giving customers choice and control over their data, is a threat to Splunk. Splunk has alleged many things in its filing, but the core of its claims are around intellectual property theft by me personally around the Splunk to Splunk (S2S) protocol. Since 2014 or before, implementations of the Splunk to Splunk (S2S) protocol have been open sourced for delivering data to Splunk. An implementation of S2S in Splunk Eventgen is still available under an Apache license, assuming they don’t take it down after this blog is published.

This is important because nothing prevents Cribl from leveraging implementations that Splunk itself makes available to everyone to allow interoperation with their core engine. And that is what we did by ensuring our software can interoperate with Splunk through the S2S protocol. Cribl’s joint value proposition with Splunk is unmatched. Together, we provide a cost-effective best in class solution. Our future offerings continue to be designed to complement Splunk’s offerings.

As proud Splunk alumni, Cribl’s founders are disappointed to see Splunk, a company with great products and great people, descend to using strong arm tactics to try to maintain their growth rather than focusing on their customers. We remain a big fan of Splunk and welcome an opportunity to partner for the benefit of our customers. We remain excited to work with our customers to provide them a path to open observability.

Cribl delivers choice and control to our customers. We will vigorously defend ourselves against these baseless accusations in court, here, and other public places.