Case Study: American Retailer cuts SIEM migration time and Splunk ingest costs with Cribl

American Retailer cuts Splunk ingest by 25% and migrates SIEM in 3 weeks with Cribl

The customer, an American retailer, faced a significant challenge after becoming an independent public company. As part of a major divestiture, its security team needed to establish a new technology infrastructure, reduce Splunk software costs, and migrate to a new SIEM solution. To achieve these goals, the retailer turned to the vendor Cribl and implemented its Cribl Stream and Cribl Edge products.

Cribl provided a solution that simplified data collection by replacing Splunk Universal Forwarders with Cribl Edge nodes. This implementation reduced Splunk software ingest by 25%, cutting licensing costs from 1TB to 750GB per day. Furthermore, Cribl enabled the team to evaluate three SIEM solutions simultaneously and then powered a migration to Google SecOps, accelerating the process from an estimated six months to just three weeks.