Cribl pricing in 2026: Stream credits, Lake, Search, and real savings math
A Cribl pricing reference. The credit model, free-tier limits, tier comparison, Cribl Detect's credit tiers, worked savings math against Splunk ingest, and four customer scenarios. Compiled from Cribl's published pricing pages (cribl.io/pricing/plan, /stream, /lake, /search and /detect) and its 29 September 2026 Cribl Detect launch announcement. Last reviewed October 2026.
Page updated 13 October 2026/First published 2 June 2026
Plan limits from cribl.io/pricing/plan (Free: up to 1 TB/day, 1 worker group, 10 worker processes, 100 edge nodes, 10 search executors, 50 GB Lake). Stream rates from cribl.io/pricing/stream (0.32 credits/GB Enterprise Cloud Worker, 0.27 Standard Cloud Worker, 0.26 Enterprise Hybrid Worker, $1 = 1 credit). Both read 13 October 2026. These are Cribl's published list rates.
How much does Cribl cost per GB in 2026?
Cribl bills on consumption credits, where one credit equals one US dollar. Cribl Stream lists 0.32 credits per GB ingested on the Enterprise Cloud Worker (plus an infrastructure fee for Cribl-managed workers), 0.27 credits per GB on the Standard Cloud Worker, and 0.26 credits per GB on the Enterprise Hybrid Worker you run yourself. At 500 GB per day Enterprise Cloud ingest credits are $58,400 per year, or an estimated $73,000 all-in if the unpublished infrastructure fee adds about 25 percent (our assumption); at 1 TB per day, ingest credits are $94,900 on Hybrid Workers and $116,800 on Cloud Workers. The free tier covers up to 1 TB per day with 100 edge nodes and 50 GB of Lake capacity. Standard runs to 5 TB per day with 8x5 support. Cribl Lake lists 0.05 credits per GB per month Cribl-managed and 0.10 Direct Access, on compressed data stored. Cribl Detect, launched 29 September 2026, is sold in fixed monthly credit tiers from 1,808 credits/month at 75 GB/day to 89,612 at 4.8 TB/day. The infrastructure fee, the Search Consumption and Lakehouse unit rates and Enterprise commits are not priced on the public pages.
At $0.32/GB ingest (0.32 credits/GB). Cloud Worker all-in is higher once Cribl's infrastructure fee for managed workers is added; it is not priced on the public page.
What Cribl is, and why it matters for SIEM cost
Cribl is a telemetry pipeline. It sits between your log sources (servers, firewalls, applications, endpoints) and your SIEM (Splunk, Sentinel, QRadar, Elastic). Logs flow into Cribl, get filtered and reshaped, then route to one or many destinations. The expensive SIEM only receives the data that matters for detection. The verbose noise goes to cheap storage or gets dropped.
This matters because SIEM pricing is overwhelmingly ingest-metered. Splunk Cloud base ingest lists at $1,265 per GB/day per year at a typical 50 GB/day deployment (and Enterprise Security adds about 96% at that band, 55-75% above it); Microsoft Sentinel analytics logs are $4.30 per GB pay-as-you-go in East US. At those rates, every gigabyte of debug chatter, DNS noise, or verbose Windows event you do not actually use for detection is taxed at SIEM prices.
Cribl lists 0.32 credits per GB at the input side on the Enterprise Cloud Worker (one credit equals one dollar), plus an infrastructure fee for Cribl-managed workers. At 500 GB per day, that is $58,400 per year in ingest credits, or an estimated $73,000 all-in assuming the unpublished infrastructure fee adds about 25 percent. Whether filtering pays for Cribl depends on how much of your ingest you can drop or divert: Cribl's cost-control page claims its pipelines cut data sent to costly analytics or storage tools "by up to 50%" (cribl.io/solutions/initiatives/cost-control), which is the vendor's claim, not a measured average.
The five Cribl products
The router. Receives telemetry from forwarders or agents, applies pipelines (filter, reshape, route), and sends to one or many destinations.
Lightweight agent that runs on hosts and edge devices. Replaces Splunk Universal Forwarder, Fluentd, or Beats for many use cases.
Cribl's own storage tier. Stores raw telemetry for replay, late-arriving SIEM ingest, or long-retention compliance.
Federated query across Cribl Lake and external data stores (S3, Splunk, Elastic) without re-ingesting.
Launched 29 September 2026, which Cribl describes as "a complete security information and event management (SIEM) built on the platform security teams already trust".
Sources, read 13 October 2026: cribl.io/pricing/stream, cribl.io/pricing/lake, cribl.io/pricing/search, cribl.io/pricing/detect and the Cribl Detect launch announcement (cribl.io/news, 29 September 2026).
Cribl Detect pricing: credit tiers by daily ingest
Cribl Detect, launched on 29 September 2026, is described by Cribl as "a complete security information and event management (SIEM) built on the platform security teams already trust". It is priced in fixed monthly credit tiers sized by estimated daily ingest, with unlimited in-stream detections, correlations, coverage and posture management, alert and triage workflows, contextual enrichment and integrations included. There is no free tier for Detect, and above 5 TB per day pricing is by quote. Credits are invoiced monthly at $1 = 1 credit.
| Tier | Estimated ingest/day | Credits/month | USD/month | USD/year |
|---|---|---|---|---|
| Micro | 75 GB/day | 1,808 | $1,808 | $21,696 |
| X-Small | 150 GB/day | 3,615 | $3,615 | $43,380 |
| Small | 300 GB/day | 6,873 | $6,873 | $82,476 |
| Medium | 600 GB/day | 13,062 | $13,062 | $156,744 |
| Large | 1.2 TB/day | 24,821 | $24,821 | $297,852 |
| X-Large | 2.4 TB/day | 47,163 | $47,163 | $565,956 |
| 2X-Large | 4.8 TB/day | 89,612 | $89,612 | $1,075,344 |
| Above 5 TB/day | >5 TB/day | Contact Cribl sales | ||
Source: cribl.io/pricing/detect, read 13 October 2026. USD columns convert the published credits at Cribl's stated $1 = 1 credit; the annual column is the monthly figure times 12. Launch date and description from Cribl's launch announcement.
Tier comparison: Free, Standard, Enterprise
- · 1 worker group, 10 worker processes
- · 100 edge nodes, 10 search executors
- · 50 GB Lake capacity
- · Community support
- · 1 worker group, 50 worker processes
- · Unlimited edge nodes and search executors
- · Unlimited Lake capacity
- · 8x5 support
- · Unlimited worker groups and processes
- · Unlimited edge nodes and search executors
- · Unlimited Lake capacity
- · Dedicated 24x7 support team
Source: cribl.io/pricing/plan for limits and support, and cribl.io/pricing/stream for the per-GB credit rates, both read 13 October 2026. The Standard annual figure is the published 0.27 credits/GB times 500 GB/day times 365; the infrastructure fee for Cribl-managed workers is not priced on the public page.
The Splunk savings math, worked
The 40 percent filter ratio is an illustrative assumption, not a measured outcome; Cribl's own claim is "up to 50%" less data sent to costly tools, and your ratio depends on your sources. Cribl line: $58,400 in ingest credits (0.32 credits/GB published on cribl.io/pricing/stream, times 500 GB/day, times 365) plus an estimated 25 percent for the Cribl-managed infrastructure fee, which Cribl does not publish. Splunk lines: base plus Enterprise Security on the filed G-Cloud 15 ladder ($1,334 per GB/day per year at 500 GB/day; $1,562.28 at 300 GB/day).
Real-world Cribl cost scenarios
| Scenario | Profile | Cribl cost | Splunk before | Splunk after | Notes |
|---|---|---|---|---|---|
| SMB / startup | Under 1 TB/day ingest, single team, basic routing | Free tier ($0) | Up to ~$63K/yr base at 50 GB/day | Lower by whatever share is filtered | Free tier covers up to 1 TB/day, 1 worker group, 100 edge nodes |
| Mid-market | 500 GB/day total ingest, Splunk + S3 destinations | ~$73K/yr Cloud (est.: $58,400 credits + infra fee) | $667K/yr list (base + ES) | ~$469K/yr (filtered to 300 GB/day) | Net saving ~$125K/yr (19%) after Cribl, at an illustrative 40% filter |
| Enterprise | 1 TB/day, multi-destination, ES on Splunk | $94,900 Hybrid credits to ~$146K Cloud all-in (est.) | $1.29M/yr list (base + ES at $1,288) | ~$800K/yr (filtered to 600 GB/day) | Net ~$342K/yr (Cloud, est.) to ~$393K/yr (Hybrid, before your own infra) |
| Large enterprise / MSSP | 5 TB/day, multi-tenant, dedicated worker fleets | $474,500 Hybrid credits to ~$730K Cloud all-in (est.) | $5.98M/yr list (base + ES at $1,196) | ~$3.73M/yr (filtered to 3 TB/day) | Hybrid Workers bill 0.26 credits/GB, 19% less per GB than the 0.32 Cloud Worker rate, before your own infra |
Splunk costs are all-in (base ingest plus Enterprise Security) at filed list per-GB rates ($1,265 per GB/day per year base at 50 GB/day, tapering with volume; ES adds about 96% at 50 GB/day and 55-75% above that). Splunk publishes no per-GB price on splunk.com; its end-customer list prices are public through its UK G-Cloud 15 filing and the AWS Marketplace Splunk Enterprise listing. At 1 TB/day the filed rate is $822.25 base plus $465.75 ES = $1,288 per GB/day per year; at 5 TB/day, $764.75 plus $431.25 = $1,196. Premium apps such as ITSI are excluded because no list price is available. Actual customer spend depends on EA discounts, Cloud vs Enterprise, retention, and premium app stack. Cribl figures are the published Stream credit rates on cribl.io/pricing/stream times volume times 365; "Cloud all-in" adds our estimate of 25 percent for the unpublished infrastructure fee. Every "after" column assumes an illustrative 40 percent filter.
When Cribl is the right call, and when it is not
- + Splunk bill above $300K/yr
- + Multiple destinations needed (SIEM + data lake + analytics)
- + 30%+ of ingest is detection-irrelevant noise
- + Migrating SIEMs and need to dual-route during transition
- + Compliance retention without paying SIEM hot-tier rates
- - SIEM bill is under $100K/yr (the math does not work)
- - Single destination, simple log flow
- - Already on Sentinel with Microsoft 365 source data (free ingest)
- - No engineering capacity to design pipelines properly
- - Below 200 GB/day total ingest