Cribl.Cloud Suite

We are using Cribl for log trimming with a vast majority of log sources that have different log patterns or log types. Some logs come in syslog format, some are in JSON, and some are in other HTML kinds of formats. We are using Cribl to streamline all the log formats and send the logs to Splunk, and we can also filter out the logs that are not required for us for security monitoring.

If logs from one device are sending us a lot of logs but we only need some events of interest for security monitoring, we can filter out the unnecessary logs and only forward those events of interest from Cribl to our SIEM solution.

Cribl has had a very positive impact on our organization. We are also using it for our cost cutting. The first benefit is cost cutting because we can filter out the unnecessary logs from the log sources, so we are only sending the events of interest to our SIEM solution for security monitoring. Most of the logs that are not necessary are filtered out within Cribl, which positively impacts the pricing of our SIEM solution.

The second benefit is that it has improved our security monitoring because Cribl is an augmented solution that can pull any log format, convert it, and send it to the SIEM solution. There is no requirement to have a specific log type to use Cribl. The third benefit is the filter option, which allows us to filter out the unnecessary logs.

In our organization, we are keeping the logging level of the firewall up to debug and forwarding all the logs from the firewall to our SIEM solution for security monitoring, so specifically for the firewall, we do not have any filtering in place in Cribl.

We can filter out the firewall logs if we keep the logging level up to informational, which would allow us to filter out all the debug logs through Cribl, which will definitely reduce the firewall traffic.

In our environment, we are handling around TBs of logs through Cribl, and it is handling everything perfectly fine. We have not observed any issues with traffic, log stoppage, system failures, or service failures related to Cribl, so everything is working fine.

The overall pipeline and the filtering option in Cribl are very good.

The complexity aspect is impressive; Cribl is already augmented and can receive any kind of logs with any format. It can handle almost all types of logs, which include Syslog, WMI, and all kinds of complex logs. It is particularly very good for complex logs where we have multi-line logs and large sources sending a significant quantity of logs; it is very helpful in that regard. Regarding the costing part, Cribl's charges are less than what we are saving in our SIEM solution, so ultimately, it is profitable for us.

Currently, Cribl is perfectly fine for us, and we have not observed any such issues. However, if we find anything later on, we will document it and share it with you.

Cribl could respond more quickly to email notifications to make the experience a nine or ten.

We have been working with Cribl for around eight months because we recently implemented it, so it has been six to eight months.

Cribl is a very stable product, and we have not observed any platform-related or internal service-related issues. It has been working fine since six to eight months, so we can say it is pretty stable.

We have not experienced any outages or crashes.

We can scale Cribl based on the log inputs we are providing. It is pretty much scalable, depending on when we want to scale it.

It has an option for scalability, so it is not an issue.

We often communicate with the technical support of Cribl.

They are very supportive and respond timely.

This is the first time we are using Cribl; previously we were directly sending logs to a SIEM solution. This is the first time we started using Cribl for that.

We were not personally involved in the implementation because there are multiple members on our team. One of our colleagues was involved along with Cribl resources to implement it. However, later on, once it was implemented, we got a chance to work on a few changes in Cribl.

In this particular area, we think Cribl is the only good solution partner, which is why we chose Cribl. There are no other applications that have that kind of capability like Cribl, as it is the industry-leading product as of now.

We went straight to Cribl and did not consider anything else.

We can share our feedback on Cribl.

We are a customer of Cribl.

Cribl is a pretty good solution. We did not face any challenges while working on Cribl.

Cribl is deployed on the cloud in our organization.

We are happy with the pricing that they offer.

Our review rating for Cribl is 9.

My current use cases for Cribl involve how the telemetry data moves. We have instrumented our observability backend related services, which we use specifically for our business logic. Basically, how it works is there is something called Autopage where we have all the details of whatever data was just coming in terms of from the adapters of AWS. There, we have Cribl deployed even when no queue queue Kubernetes cluster exists. We have these things and we're very well organized. Most of the use cases are on Kubernetes where we have better observability because Kubernetes generates a lot of traces, and manually, it is very difficult to manage all these things. Cribl plays a good amount of role to summarize everything properly provided all the information.

What I like the most about Cribl is that it extracts the spans very well. Honeycomb does the same thing, but Cribl does it a little bit better than that. We can route one stream from too many destinations with no problem. We have configured a center table easy instance, and we have also tried with the cloud solution. When we send the data in, it just gets extracted in different telemetry solutions such as signals and data doc. It provides all those enriched data with all the details. For example, we gave user ID as one of the attributes we wanted, and it mapped email on top automatically. So it becomes very easy to identify which customer has a problem during incidents and other things.

I'm not the right person to ask this because I only configured it for providing certain specific things. If I say one negative thing, the setup is a little bit trickier because observability setups are generally trickier.

I have been using Cribl in my career for six and a half months.

Regarding stability, I don't really face any lagging or crashing, but that comes with not a lot of data being injected there. If a very high cardinal solution or high cardinal metrics goes in, there might be some issues, but I haven't faced any problem that way till now.

Scalability, stability, and reliability can only be judged when you have a huge amount of data. Our current organization doesn't deal with a huge amount of data. What we have is around two hundred to three hundred GB of data that we are moving daily. Out of that, whatever telemetry we are getting from our total collector, there's something which we are directing to this, and this is providing to our other solutions out there such as Datadog and Honeycomb. Basically, we are not facing any problem as of now in terms of stability, reliability, and scalability.

In terms of technical support, I have not had to contact them about anything. Technical solutions are shifting now. People are more identifying things on their own, and we have a lot of solutions coming, so it's very easy now.

The initial deployment setup of Cribl was relatively easy for the first time. This comes after a certain new experience that I have. For a very new person who doesn't understand much about observability, it might be a tricky solution. When you are working with an OLTP kind of solution, versioning, pipeline, learning, and coverage are important parts. Once you have that, everything works accordingly. You just have to figure out how it will work.

I really enjoyed working with the open telemetry collectors. I have tried with some AI-related implementations. We have a vector database in the backend, and it has given us a good amount of data transformation depth, which was really good. That has given us more usage context for what we are providing to the AI model. This is a service what we had in AWS Bedrock where we were running an NLM solution. That has given us good amount of insights whether this is properly working or not. The only problem was there was no token count. For that, I have to use some different solution. For a specific integration, I would be very happy if I could get some other solution which provides me the token information also. How much token I have been consuming is not there right now in any of the auxiliary tools. I have to do it via some other aspect. No complaints with Cribl. Cribl actually has sorted out our problems, but it will probably be better.

For the deployment of Cribl, I have done the complete deployment without anyone's help. I took some documentation that they have and used it for certain structural things. For our department's sake, I deploy our changes directly without any problem.

I have seen a decrease in firewall logs with Cribl. Sampling is enabled and definitely that is something which I have actually seen a good amount of reduction in. The logs are really high, so what we had previously because a lot of those kinds of things happen on the valve, followed by a lot of things that happen on our product. Because of that, the logs get filled up very fast, and we store all those logs in history. When I compared the situation after Cribl and when we actually validated whether the amount of logs in the history compared to what they were before, the growth results significantly decreased. I don't have a number in mind right now, but I have documented it somewhere.

Regarding the pricing of Cribl, I'm not the right person to talk about pricing because all these things are taken care of by our VP of engineering. I suggested them to ship also, and then we are on a pilot with them. We have not paid any money to them yet. With respect to this current Cribl implementation, I am not hundred percent sure what we have actually done. I can answer the technical aspect of it, but the financial part is something that's out of my scope right now.

When it comes to using any similar solutions to Cribl, there are not really alternatives. We have used Chip, if you have heard of it. But the use cases are a little bit different. Chip is something which provides more enhanced metrics on top of existing metrics of what we have. So we don't have to look at ten different metrics, and we can use this. They have run a pilot with us a while back, but they are focused mainly on Kubernetes clusters, whereas our solution is more tied to the instances and other things. These are not a cluster mode running. In our case, it has given us significant value.

Regarding Cribl's ability to handle high volumes of diverse data types, for logs, it is something we have used. We have used it specifically, and I'm not saying I know how to use it completely, but not that much, to be honest. It's okay what we have done.

In my experience with Cribl's new search in place technology, Cribl search, I find the user interface when managing log processing tasks to be decent. I don't have any complaints.

I would give Cribl an overall rating of eight out of ten.

We started using Cribl one year ago for data optimization.

Currently, we are using Cribl for its one terabyte ingestion that is free, which is one significant advantage. We are using it for that purpose only at this time. We are a customer and we are planning to purchase it, with almost a deal in progress. This month or next month, we will be purchasing Cribl.

Currently, we are not using metrics; we are using Cribl only for event-type logs. We do not have much data for metrics, so we are directly flowing that to Splunk. For logs, we are using Cribl, and there is also monitoring available, which is very good. Cribl's monitoring dashboard has a lot of graphs by default, so we can use that to populate our searches and run them, which is helpful.

We are using Cribl Stream for our streaming purposes and not using Edge due to our existing Splunk agent deployment. We occasionally use Cribl Search to investigate, especially during the deployment phase, which allows us to search some internal Cribl logs. We use Cribl Lake to store the internal data.

We utilize Cribl Search only for internal purposes. For example, when we experience back pressure issues, we search that particular source in Cribl Search to check their source logs, how back pressure was created, when it occurred, and what errors arose. We only keep internal logs in Cribl Lake, enabling us to search them. Cribl Stream's monitoring dashboard shows everything, including when there is a spike, the KVP data, and all related information.

Cribl's best feature is that the UI is very simplified, so if a new person is there, they can easily understand everything. The UI is very simple and good. Other than this, data flow and data visibility are among the best features. We can directly see how our data is going from where to where and with the live data, live logs, everything we are able to see.

I find that it is very easy to describe my experience with the user interface when managing log processing tasks. It is very easy to manage all the data and all the data flows. Everything in the UI is very easy. Also, there are a lot of sources, a variety of sources, a variety of destinations available, many ports, data, and many scripts. Everything we think of is available in Cribl, so from wherever we think we can get the data and wherever we want to put it, we can put that as well.

For firewall logs, there is a default parser available in Cribl, so we are using that parser. In addition, there are many default parsers for various firewalls such as Palo Alto and Fortinet. This is very helpful to us as it will extract all the data, and we can remove the fields that are not required, which is reducing a lot. This is one reason we are purchasing Cribl for Splunk.

Cribl brings two main improvements to our organization. The first improvement is cost saving, as we can save a lot of cost by reducing the data. The second important improvement is the data quality, which is also one of the most critical aspects because it filters the data and makes it whatever we want to see. Cribl helps us manage our data quality very well. Since we are in the beginning phase of using it for one year, I believe this product will help a lot as time goes on.

One improvement Cribl could work on is Cribl's Git integration. If I want to integrate my private repository, I can do this, but there is a specific format required in Git. If I commit something to Git, Cribl won't pull it automatically. We can upload from Git to Cribl, but not the other way around, so that is an area that needs to be addressed.

We started using Cribl one year ago for data optimization.

Stability-wise, Cribl is a very stable platform with no issues.

In terms of scalability, Cribl is indeed scalable. We just need to increase the license. Currently, we pass 600 to 700 gigabytes of data through Cribl, and we plan to increase more, up to two terabytes. For that, we will need to purchase an additional license, but as time goes on, we just need to increase our license.

I rate the technical support as a nine out of ten.

There are other vendors such as Splunk, which includes its default solutions such as Splunk Edge Processor or Splunk Ingest Processor. I have heard about them, but they tend to be very technical, requiring a lot of queries. While there is a UI available, you cannot see the data flow properly. It becomes very difficult to manage your data on other platforms. In contrast, Cribl simplifies everything, with default systems and routes that allow your data to go through a pipeline to its destination. There is a straightforward flow where you check live data, can test your pipeline, and it is all very simplified compared to other platforms, which often require excessive queries to resolve issues. Fixing problems in Cribl takes thirty minutes instead of wasting a whole day in other products.

Cribl's deployment is very easy and straightforward, similar to Splunk. If you know how to install Splunk, then it is a copy-paste process. It is not complex for us since we also deploy Splunk on-premises.

For now, we are just an end-user.

Currently, we are using Cribl on-premises, and I think we have not explored it much. However, I can say that everything is good; I do not find anything needing improvement since I do not have a deep dive into this product.

Maintaining Cribl is easy; we do not see any downtime or major issues at all. Sometimes we experience back pressure issues due to source spikes, but they are acceptable as they come from the source and not from Cribl's end. Cribl effectively manages these situations, addressing spikes from sources and destinations.

As of now, we maintain five years of data, and we have not changed that. However, we plan to increase retention from five years to seven years with Cribl since we now have less data. Currently, we have 100 terabytes of data, and eventually, we aim for 700 gigabytes, which is significantly less.

I will surely recommend Cribl to everyone who has data exceeding one terabyte because it helps a lot for such customers. They can send data to multiple destinations and stream solutions, significantly enhancing data quality and reduction. Thus, purchasing Cribl is essential for them.

I give Cribl an overall rating of nine because I am not well-acquainted with Cribl Edge. I have just heard about the in-place search feature, but I have not explored that area, so I cannot comment on it. I am familiar with Cribl Stream, Lake, and Search, which is why I give it a nine instead of a ten.

We mainly use Cribl for data optimization and log reporting to clean up the data and determine how to pass and provide this data to Splunk, which we are using. Cribl serves as a pipeline for us.

Cribl has impacted our organization very positively. Our management team was previously very concerned about costs. If we were using the traditional method, we would be giving every log to Splunk, and it became very messy and tough to handle. Because of Cribl, we have experienced very high impact in cost efficiency, data clarity, and data optimization. It has been a very big impact.

The best feature is data cleaning and data optimization, which has reduced our costs significantly. Cost optimization can be counted as one of the valuable features.

My experience with the UI is very decent compared to others, and it is very good.

Cribl handles fire logs very well because we are getting logs from many of our applications. We collect the data from APIs and everything, and it works very well with fire logs.

Cribl has handled our needs very easily and very stably. We have depended on it, and it works very well. Data costs have become very low, making it more reliable in terms of cost efficiency.

The main improvement is to provide a very clear and comprehensive user manual.

Another main improvement I would like to see is if we could get an advanced monitoring system or advanced monitoring capability, we could use Cribl in a very advanced way.

We have been using Cribl for mainly around ten months.

Cribl is very stable. Once the pipeline is configured properly, it runs consistently, even with high volume. We have not faced any major issues.

From my experience, Cribl is quite scalable and very scalable. We are using it with very high volume, and it is very scalable.

Cribl's customer service is good. We have tried contacting them one or two or three times, and it has been good.

We are using Splunk currently, but we were giving logs directly to Splunk without any clarity, without any cleaning, and without any optimization. We were giving everything to Splunk, and because of this, it became very messy. We had to make a call to Splunk's help section for assistance. Now that we are using Cribl, it is very good, and we do not have to rely on Splunk's support to help us.

Cribl's initial setup is quite complex. That is why I am recommending that they provide a very comprehensive user manual.

We integrated Cribl by ourselves.

Cribl is reliable, and while the ROI is not as significant as other metrics, we have already exceeded it because the costs are very low.

The costing part is not something I directly handle, but from what I know, the setup cost is very low.

We have not checked any other options because this option has matched our requirements.

I would like to recommend providing a very clear and comprehensive user manual so that any newcomer or new customer can understand it very easily. Our review rating for Cribl is nine.

I have used Cribl Stream for filtering service logs, reducing data volume before sending it to Splunk, and enriching logged data with custom context.

Cribl features integration support since it works with 50 plus sources and destinations, data routing and flexibility allowing me to easily route telemetry to multiple destinations such as SIEM, data lake, and cheap object storage, and data processing and reduction because it filters out unwanted fields, removes redundant data, and restructures logs before reaching systems, which is helpful in saving cost and improving performance.

We have observed a 30 to 40% reduction in log volume hitting the firewall.

Cribl Stream handles a high volume of data very efficiently as it is designed to process log metrics and data from multiple sources in real time without major performance impact. We tested Cribl Stream with different types of machine data and even with large ingestion volumes, and the platform remains stable because of its distributed and horizontally scalable architecture.

I can assess Cribl's ability to handle high volumes of different data types, as it can handle multiple formats because it supports structured and unstructured data formats such as JSON, CSV, XML, and plain text logs. It processes and transforms data in real time with low latency. In our PLM environment, we had logs coming from multiple enterprise systems and services, and Cribl helped normalize and route those diverse logs efficiently before forwarding them to Splunk.

My experience with the user interface when managing log processing tasks is quite complex for new beginners, and there is also a documentation gap that leads new beginners to take a while to get fluency over the software.

Areas that have room for improvement include the complex UI for beginners and the documentation gap. One challenge initially was configuring pipelines and understanding parsing rules because of this gap, and I think there should be more plug-and-play integration examples for common enterprise tools.

I have been using Cribl for 13 to 14 months.

Cribl is a stable solution, and overall, I give it a 10.

Cribl's architecture is quite scalable because it horizontally scales whenever required, so I give it a nine for scalability.

I would rate the technical support as nine out of ten.

This is my first time using this type of solution, and I have not used any other alternative or competitor solution, so I am not aware of other options.

My team members mentioned that it was not difficult to deploy it; it was handled by two of our IT team members.

I find the pricing of Cribl to be cost-efficient because it has helped us save costs for data storage by removing unwanted logs.

I am aware of Cribl Search and its new search in-place technology, but I have not used it.

I am pretty new to Cribl and have only used Cribl Stream, but I am looking forward to exploring other products such as Edge, Search, and Lake.

I would highly recommend Cribl because it has been very helpful in cost optimization. I give this review an overall rating of 9.