Cribl: Observing the Right Trend

We have just, today, announced a Series C investment in Cribl, and we are excited to share the news. Cribl is made up of a world-class group of people who are focused on making control and flexibility a possibility for observability teams, removing the trade-offs between storing/analyzing more data vs. spending more time/money. If cost were no object, most teams would store more data.

Cribl provides an ‘observability pipeline’ built to route security and machine data to where it has the most value to a business. With Cribl you can reshape, reduce, or route data so that you remain compliant and get the insights you need in the most cost effective way possible. With data volumes mounting, data sources expanding, and logging systems at capacity, enterprises like TransUnion and Shutterfly figured out that with Cribl, there is a better way.

We have known the founding team for years and watched former highly-regarded colleagues and executives from past IVP portfolio companies flock to the team. Each time we noticed. Person by person, the team alone is enough to get us excited, but we have elaborated here on a few other facets of our thinking.

Strategic Turf

We believe Cribl is valuable because of where they sit in the flow of data, in this particular case, upstream from where the data ultimately resides. Cribl is applying logic to the stream of data, after being emitted from the source, and before reaching a data store (or stores) for safe-keeping. Cribl, by sitting where they sit, is starting to disaggregate systems that previously owned the data they collected, and by taking a Switzerland approach the product can work with all pre-existing vendors.

Cribl introduces flexibility, allowing a customer to keep all existing infrastructure and not replace anything. Allowing a customer to choose what data to keep, in what format, sent to what data store, and all with a full fidelity copy into low-cost storage (e.g. Amazon S3). Cribl, by sitting upstream of the database, becomes the brains and logic for observability teams and over time Cribl can suggest where to send the data.

New Category

Cribl is in the midst of creating a new category. Applying logic to streams of data has been done, with one successful example being Confluent and their Kafka project. In that case Kafka was focused on event data, whereas Cribl is focused on observability data. What was once known as infrastructure management and other less buzzy terms, is now coined ‘observability’ and the market as a whole has emerged with dollars behind it. Companies like Splunk, Datadog, AppDynamics, Sumo Logic, and Grafana have helped make the name.

Purpose-built data repositories and purpose-built monitoring and tracking systems are common-place, but a Kafka-like pipeline for observability data has been conspicuously absent. We estimate that the volume of machine data vs. event data is on the order of 10:1. We see an opportunity in enabling teams to optimize some systems for data retention and others for data analysis, and then route data accordingly.

Product-Market Fit

We talked to a lot of customers and prospective customers during our evaluation process. We were struck by the consistency of the types of customers, their problem statements, their reasons for buying, and the expectations for how they might grow their usage over time. If product-market-fit is the idea that a company’s target customers are buying, using, and telling others about the product in large numbers, we saw that here. Customers buy for cost-savings and they expand when they see the flexibility Cribl can introduce.

We are continually evolving and trying to learn from our wins and our missteps, but when things really work, we try to do more of it. IVP has a long history of investing in companies that are sold into the engineering organization, be it GitHub or Datadog adopted by developers, or AppDynamics and Sumo Logic, sold into IT and IT operations. The stories have all ended well and all fit in this broad category where Cribl sits: observability. We look forward to taking part in ensuring Cribl will fit the pattern!

Cack Wilhelm, Jason Kong, Army Tunjaicon, Eric Liaw, and Tom Loverro are investors at IVP, a later-stage venture capital firm based in Menlo Park, CA.