In the Cribl vs. Splunk lawsuit, a California federal jury found in April 2024 that Cribl willfully infringed Splunk’s copyright and breached a license agreement, but it awarded Splunk just one dollar after Splunk failed to prove its claimed $154.9 million in losses. Judge William Alsup then ruled that most of Cribl’s copying qualified as fair use and entered a narrow permanent injunction that bars Cribl from using Splunk Enterprise for marketing while allowing reverse-engineering and interoperability testing. Splunk appealed in January 2026, and the appeal is still pending.1
Why Splunk Sued Cribl
Splunk filed its 85-page complaint on October 5, 2022 in the U.S. District Court for the Northern District of California. The case was assigned to Senior District Judge William Alsup.
Cribl was founded in 2018 by three former Splunk employees, including CEO Clint Sharp. Its flagship product, Cribl Stream, is an observability pipeline that sits between data sources and analytics platforms and is designed to interoperate with Splunk Enterprise. Cribl was originally part of Splunk’s Technology Alliance Partner program, which licensed it to use Splunk Enterprise for building integrations. Splunk terminated that TAP agreement on November 2, 2021, alleging Cribl had turned from a complement into a direct competitor.
Splunk’s core allegations centered on the Splunk-to-Splunk protocol, or S2S. Splunk claimed Sharp had created a derivative of Splunk’s S2S source code while still employed at Splunk, posted it to his personal GitHub as “go-S2S,” added an MIT open-source license to it around December 2018, and kept it online until at least December 2021. Splunk alleged that code, or derivatives of it, ended up in Cribl Stream. Splunk also alleged that Cribl made unlicensed copies of Splunk Enterprise for development and marketing, recruited Splunk employees and encouraged them to bring confidential documents, and disparaged Splunk to customers. Five patents were also asserted, and Splunk sought $154.9 million in damages.
Sharp publicly called the claims “baseless,” arguing that the S2S protocol had been open-sourced through an Apache-licensed implementation in a Splunk project called “Splunk Eventgen” and that Cribl used publicly available information to make its product talk to Splunk’s platform.
What the Judge Dismissed Before Trial
Judge Alsup narrowed the case substantially before it reached a jury. In a March 2023 order, all five patent claims were dismissed under the Supreme Court’s Alice framework, with the court finding the representative claims directed at abstract ideas without an inventive concept beyond “generic processes and machinery.” The willful and indirect patent infringement claims were also dismissed for lack of plausible allegations of pre-suit knowledge.
Several other claims fell away by stipulation. The parties dropped the DMCA anti-circumvention claims and all claims against Sharp personally. The copyright claim targeting the S2S protocol itself was also resolved by stipulation, with the court noting that the protocol was a data format that was “never copyrightable.”
What remained for trial: copyright infringement tied to Cribl’s use of Splunk Enterprise software, breach of the TAP license, breach of the Splunk General Terms license, tortious interference, and California unfair-competition claims.
The Split Jury Verdict
The case went to a two-phase jury trial in April 2024.
In the first phase, ending April 17, 2024, the jury made factual findings that shaped everything that followed. It found that using the S2S protocol was required for Cribl Stream to viably interoperate with Splunk Enterprise, that alternatives like the HEC protocol were not viable, and that achieving S2S support required reverse-engineering using Splunk Enterprise. The jury also found Cribl’s copying was transformative and benefited the public. On whether Splunk would have earned more money without the copying, the jury answered “unknown.”
In the second phase, ending April 22, the jury found Cribl did not misappropriate Splunk source code but did willfully infringe Splunk’s copyright in Splunk Enterprise through non-fair uses, specifically marketing activities. It found Cribl breached the Splunk General Terms license but did not breach the TAP license, and that Splunk’s termination of the TAP agreement was not itself a breach.
Damages: one dollar. Judge Alsup had instructed jurors to award nominal damages if Splunk failed to prove actual damages, and with the “unknown” answer on the revenue question from Phase One, the jury concluded Splunk had not shown the $154.9 million loss it claimed.
The Fair Use Ruling
The fair use decision is the most legally significant piece of the case. Based on the Phase One factual findings, Judge Alsup ruled as a matter of law that Cribl’s reverse-engineering, testing, and troubleshooting for interoperability were fair use under 17 U.S.C. ยง 107. Using Splunk Enterprise for marketing was not.
The court drew on Google LLC v. Oracle America, Inc. and Ninth Circuit precedent from Sega Enterprises Ltd. v. Accolade, Inc. and Sony Computer Entertainment, Inc. v. Connectix Corp. The court found Cribl’s reverse-engineering transformative and drew a line between “incidental” use for interoperability and “exploitative” use for marketing. It treated Splunk Enterprise as functional rather than purely creative, called Cribl’s copying of the entire executable object code “reasonably necessary” for reverse-engineering, and rated the market-effect factor a “toss-up.”
The practical takeaway: copying commercial software to reverse-engineer uncopyrightable protocols and build interoperable products can qualify as fair use, but using that same software to sell against the original crosses the line.
The Permanent Injunction
On August 14, 2024, Judge Alsup entered a permanent injunction. Cribl may copy and use Splunk Enterprise for reverse-engineering the S2S protocol, testing interoperability, and troubleshooting interoperability. It may not use Splunk Enterprise for marketing, including “using Splunk Enterprise merely to prove Cribl’s value to prospective customers.”
The order also imposes ongoing compliance obligations. Cribl must log every download or execution of Splunk Enterprise, recording the version, the employee or contractor, the date, and the purpose. It must retain supporting materials like testing scripts and internal tickets, and produce logs quarterly to Splunk’s outside counsel on a highly confidential basis. Splunk may take up to two compliance depositions of Cribl per calendar year.
Post-Trial Motions and the December 2025 Order
Both sides asked the court to undo pieces of the verdict. Splunk moved for judgment as a matter of law that Cribl’s reverse-engineering and testing were not fair use, sought a finding that Cribl breached the TAP license, and asked for a new trial on damages. Cribl cross-moved for judgment that it had not technically infringed at all, arguing no fixed copies were made, or that any infringement was not willful. Cribl also argued the Splunk General Terms were unenforceable for software downloaded through Docker’s website.
On December 31, 2025, Judge Alsup denied all of the motions. He reaffirmed fair use for reverse-engineering and interoperability, rejected Cribl’s fixation argument by pointing to evidence of RAM copies supporting the jury’s infringement finding, and found substantial evidence that Cribl’s founders knew their marketing uses “all but certainly crossed the line” and had deliberately avoided discussing the legal boundaries. The Docker download argument was treated as waived because it wasn’t raised at the charging conference or through timely written objections to jury instructions.
The Pending Appeal
In early January 2026, Splunk appealed Judge Alsup’s post-trial ruling, challenging the denial of its motions and the one-dollar damages award. As of mid-2026, the appeal remains pending and no appellate rulings have been reported.
Business Context Around the Case
Cisco completed its acquisition of Splunk in March 2024, just weeks before trial. The case continued under Splunk’s name and the acquisition does not appear to have altered the litigation strategy.
Cribl kept growing while the case ran. It raised a $319 million Series E in August 2024 at a $3.5 billion valuation, bringing total funding above $725 million. By mid-2026, Cribl’s estimated annual recurring revenue had reached roughly $300 million, its secondary-market valuation was around $4.4 billion, it counted more than 40 of the Fortune 100 as customers, and it achieved FedRAMP authorization in January 2026.
The one-dollar verdict captured the gap between Splunk’s damages theory and what the jury believed the evidence showed. The injunction, with its logging, quarterly production, and deposition rights, is the piece of the ruling that continues to shape day-to-day operations at Cribl while the appeal plays out.