

Find out in this report how the two Application Performance Monitoring (APM) and Observability solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
What we've seen is really an overall reduction of just shy of 40% in our ingest into our SIM platform versus prior to having Cribl.
The second thing is that data aggregation, sampling, and reduction that we're able to do of the data, lowering our overall data volume, both traversing the network as well as what's being stored inside of our final solutions.
In terms of reduction, we were able to save almost ~40% of our total cost.
They had extensive expertise with the product and were able to facilitate everything we needed.
Usually, within an hour, we get a response, and we are able to work with them back and forth until we resolve the issues.
Sometimes by hearing the problem itself, they will know what the solution is, and they will let us know how to resolve it, and we do it immediately.
The technical support by Gigamon Deep Observability Pipeline is good because it has a local architect in my area.
The infrastructure behind Cribl Search is also scalable as it uses a CPU and just spawns horizontally more instances as it demands and requires.
Compared to other SIEM tools I use, any slight change on the operating system end impacts a lot on our SIEM tools and other things, but Cribl performs well in that regard.
Cribl performs effectively across both market segments.
Migrating from those SC4S servers to Cribl worker nodes has truly been a game-changer.
Regarding scalability, we started with zero servers and have around 285 servers now.
Cribl is designed to deal with certain kinds of loads and is not designed to handle any scenario in the market.
A more stringent role-based access control feature would enhance security and allow granular control over what users can see and access.
When passing query logs or DNS logs, if certain malicious query patterns need to be identified or if fast-flux attacks are happening, Cribl can report that and those would definitely be a plus for them.
I would advise others looking to implement Cribl that if they are evolving Cribl Search, it would be very interesting to see more capability, more flexibility, and more ways to share the data similar to Splunk.
Over time, the licensing cost has increased.
It was cheaper than the Splunk license.
Splunk is more expensive, and Cribl appears to be more affordable.
The data reduction and preprocessing capabilities make Cribl really unique.
Cribl has a feature called JSON Unroll or Unroll function that allows you to differentiate the events; each event will come ingested as a single log instead of piling it up with multiple events.
The Cribl UI is very simple and easy to use, particularly when working with data from various sources; it makes it very easy to create pipelines, add complex logic to those pipelines, and then gives you a preview of what your data looks like before applying that pipeline and what you get after.
The Pipeline's Comprehensive Insights into data flows have helped improve operational efficiency and security.
| Product | Mindshare (%) |
|---|---|
| Cribl | 1.1% |
| Gigamon Deep Observability Pipeline | 0.6% |
| Other | 98.3% |

| Company Size | Count |
|---|---|
| Small Business | 52 |
| Midsize Enterprise | 8 |
| Large Enterprise | 36 |
| Company Size | Count |
|---|---|
| Small Business | 3 |
| Midsize Enterprise | 1 |
| Large Enterprise | 5 |
Cribl offers a data management approach with its intuitive interface, real-time filtering, and integration capabilities, effectively managing log volumes and ensuring cost-efficient data processing.
Cribl stands out for its capability to manage high volumes of logs and metrics with ease. Its users benefit from real-time data filtering and routing, which enhances data quality and processing efficiency. Cribl integrates with many vendors, enabling seamless data handling and cost reduction by, for example, routing relevant data to platforms like Splunk or Datadog and reducing unnecessary log data to save on SIEM costs. Despite being recognized for its capabilities, concerns about its pricing and the need for improvements in performance during high data volumes, Git integration, and learning resources have been noted.
What are the key features of Cribl?In specific industries, Cribl is implemented for optimizing data ingestion and managing intricate log flows. Companies leverage its capabilities for cost-effective data routing to SIEM systems, ensuring critical information reaches destinations like Splunk or Datadog. Through significant data volume reduction, organizations maintain high operational efficiency.
Gigamon Deep Observability Pipeline boosts network visibility and performance through features like NetFlow and deduplication, facilitating data flow insights and improved security. It supports traffic monitoring and management across various infrastructures.
Gigamon Deep Observability Pipeline enhances network management by offering features such as NetFlow, deduplication, header stripping, and packet filtering. These capabilities are instrumental in optimizing performance, offering users stability and improved encryption processes. Despite its robust hardware capabilities, it requires enhancements in security, filtering, and delivery time for hardware. Users note challenges with monitoring cloud networks and insufficient cluster capacity. There is also a call for improved interface design and internal traffic flow visualization.
What are the essential features of Gigamon Deep Observability Pipeline?Gigamon Deep Observability Pipeline finds application across industries for network visibility and management. It is used extensively for traffic monitoring, SSL inspection, mobile network oversight, and data center operations. Organizations leverage its capabilities to address network issues, enhance security, and streamline performance monitoring processes. Its ability to group traffic aids significantly in problem-solving and SSL detection.
We monitor all Application Performance Monitoring (APM) and Observability reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.