Splunk Inc. v. Cribl, Inc. is a United States federal lawsuit in which Splunk, the maker of the Splunk Enterprise data platform, sued Cribl, the maker of the Cribl Stream data pipeline, for copyright infringement and breach of two licences under which Cribl used Splunk Enterprise: a Technology Alliance Partner (TAP) licence and the Splunk General Terms (SGT) that apply to any business user who downloads the software.[1] After a two-phase jury trial in 2024, the court entered judgment that Cribl had willfully infringed Splunk’s copyright in Splunk Enterprise object code and breached the SGT, but had not breached the TAP licence, and that copying Splunk Enterprise to reverse engineer, test and troubleshoot interoperability was fair use. Splunk was awarded nominal damages of one dollar and an injunction.[2] The district court denied all post-trial motions on 2025-12-31, and Splunk appealed to the United States Court of Appeals for the Federal Circuit the same day.[1][5]
Background
Splunk Enterprise receives data from Splunk Forwarders installed at data sources, which send it to Splunk Indexers using the Splunk-to-Splunk (S2S) protocol. The court noted that “the fee for using Splunk Enterprise turns on the volume of data stored over time”.[1] Cribl, founded in 2017 by three former Splunk employees, sells Cribl Stream, which can sit between Splunk Forwarders and Splunk Indexers and strip low-value data, so that a customer of both stores less data in Splunk Enterprise or stores better-selected data.[1] The fair use opinion described this as potentially “reducing the licensing fees paid to Splunk” or increasing them, depending on how customers used it.[3]
On 2018-08-06 Splunk granted Cribl a TAP licence, which lets partners use Splunk Enterprise to develop and market integrating products. At all times Cribl was also licensed under the SGT, “the one available to the ordinary business user who downloads Splunk Enterprise and begins using it”. On 2021-11-02 Splunk terminated the TAP licence, saying Cribl had become a competitor, but did not revoke the SGT licence, so Cribl continued to develop and market interoperable software under the SGT alone.[1]
The dispute
Splunk announced that it filed its complaint on 2022-10-05; the Northern District of California action was docketed on 2022-12-02.[6][1] The complaint asserted patent infringement, copyright infringement of the S2S protocol and of Splunk Enterprise and its source code, circumvention of copyright-protection measures, breach of the TAP licence and of the SGT, and state-law claims. The patent claims were dismissed on motion and several others were resolved by stipulation, including all claims against Cribl’s chief executive. What remained were the copyright claims on Splunk Enterprise, the two contract claims and state-law claims.[1]
The court treated the S2S protocol as “merely a format for data and not software” that “has never been copyrightable”. To keep Cribl Stream compatible as Splunk changed S2S between versions, Cribl ran Splunk Enterprise to detect the changes.[1]
Decision or outcome
Jury verdicts
In the first phase the jury found that Cribl could not viably interoperate with Splunk Forwarders and Indexers without the S2S protocol, that alternatives such as the HTTP Event Collector were not viable, that using S2S required reverse engineering it by running Splunk Enterprise, and that this use benefited the public and was transformative; it also found that Cribl had not misappropriated source code.[1] In the second phase the jury found that Cribl had infringed Splunk’s copyright in Splunk Enterprise and that the infringement was willful; that Cribl had not breached the TAP contract and that Splunk had validly terminated it because Cribl had become a competitor; that Cribl had breached the SGT contract; and it awarded no actual damages.[4][1]
Fair use
The judge instructed the jury that Cribl’s copying and use of Splunk Enterprise “for the purpose of reverse engineering the uncopyrighted S2S protocol was fair use”, and that copying it “for the purpose of testing and troubleshooting Cribl software for interoperating with Splunk Enterprise was fair use”.[3] Using Splunk Enterprise to demonstrate it and so generate sales of Cribl Stream was not a fair use.[1]
Judgment and injunction
The judgment of 2024-08-23 entered judgment for Splunk on infringement of Splunk Enterprise object code (willful) and on breach of the SGT, and for Cribl on the source-code copyright claim, on fair use, on anticircumvention, on the TAP contract, on the state-law claims and on a statute-of-limitations defence. It also rejected Cribl’s counterclaim that the SGT was unenforceable against it, and awarded Splunk nominal damages of USD 1 and an injunction.[2] The injunction barred Cribl from using Splunk Enterprise except for licensed and fair uses (reverse engineering S2S, testing and troubleshooting interoperability), so it banned using Splunk Enterprise to market Cribl software, and it required a compliance programme in which Cribl logs its copying of Splunk Enterprise and Splunk may challenge the logs.[1]
Post-trial order
On 2025-12-31 the court denied every post-trial motion.[1] On the licence questions it held:
- SGT reverse-engineering clause. The SGT then in force prohibited reverse engineering “except to the extent specifically permitted by statutory law”; the court read the statutory fair use right as such a permission and resolved ambiguity against Splunk as drafter, “so as to ultimately allow all statutory fair uses of Splunk Enterprise”.[1]
- Internal Business Purpose and competitive monitoring. Splunk was not entitled to judgment that reverse engineering, testing and troubleshooting also breached the SGT’s “internal business purposes” and competitive-monitoring restrictions; the court reasoned that the jury’s findings were most consistent with only the marketing uses breaching the SGT.[1]
- TAP licence versus SGT. The TAP licence contained a clause by which fair use rights could be relinquished, while the SGT preserved them; the jury had been told both applied at all times and ambiguity favoured Cribl. Splunk’s argument that the TAP licence overrode the SGT had not been raised at trial and was not preserved.[1]
- Docker downloads. Cribl’s argument that the SGT was unenforceable for copies of Splunk Enterprise downloaded from the Docker website failed.[1]
Appeal
Splunk appealed to the Federal Circuit from the judgment, the injunction order of 2024-08-14 and the post-trial order, as well as the earlier dismissal of its willful and indirect patent infringement claims.[5] The appeal was docketed as No. 2026-1317.[5] No appellate decision had been published as of 2026-10-02.
Significance for software licensing and SAM practice
The case is one of few in which a court has interpreted a software vendor’s standard end-user terms against a commercial licensee that was also a competitor. The SGT was treated as a binding licence for every copy Cribl downloaded, including copies from a public container registry, and its use restrictions were enforced alongside, and independently of, the partner agreement.[1][2] The current Splunk General Terms still limit use to the customer’s “Internal Business Purpose” and list separate restrictions on reverse engineering, competitive analysis and developing competing or interoperating commercial software, so the reasoning applies to today’s terms even though their wording has changed.[7] The reverse-engineering restriction in the May 2026 version no longer contains the “except to the extent specifically permitted by statutory law” wording on which the court relied; instead a separate clause says Splunk will provide interoperability information “if required by law”.[7][1]
For licence managers the case also shows how vendor licences interact with statutory rights. A clause that carves out uses “permitted by statutory law” can import fair use into the contract; a clause that expressly waives such rights (as the TAP licence did) can narrow them.[1] Splunk described the verdict as upholding its claim that Cribl “willfully infringed our copyright in Splunk Enterprise and breached the licensing agreement that governs use of this software”.[6]
Lessons learned
- Click-through terms count. The jury found the SGT, the licence available to any business that downloads Splunk Enterprise, breached even though the negotiated partner licence was not.[4] Every download, trial and container image of vendor software brings the vendor’s standard terms with it.
- Use restrictions are enforced. Using Splunk Enterprise to market another product was neither licensed nor fair use, and was enjoined.[1] Organisations that build integrations should record which licence covers each use of a vendor’s software, particularly demonstrations to customers.
- Interoperability work can be protected. Copying the software to reverse engineer, test and troubleshoot interoperability with an uncopyrightable protocol was held a fair use, and the SGT’s statutory carve-out preserved it.[3][1] This turned on United States copyright law and is under appeal.
- Ambiguity cuts against the drafter. Where the SGT and TAP terms could be read either way, the court construed them against Splunk.[1]
- Nominal damages, real obligations. Despite a one-dollar award, the injunction imposed logging and challenge procedures on Cribl’s use of Splunk Enterprise.[2][1]