specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
provider: Cribl
providerId: cribl
publisherName: Cribl, Inc.
serviceCategory: Observability Pipeline
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Configuration
  - Data Lake
  - Data Pipelines
  - Data Routing
  - Edge Computing
  - Observability
  - Search
  - Security Data
  - Stream Processing
  - Telemetry
  - FinOps
  - Cost Management
  - FOCUS
description: FOCUS-aligned FinOps for Cribl - consumption-based licensing on processed-data volume
  (TB/day) plus tier-bound capacity (worker groups, worker processes, edge nodes, Lake capacity, search
  executors). Free tier covers 1 TB/day; Standard and Enterprise are negotiated commercially.
sources:
  - https://cribl.io/pricing/
  - https://docs.cribl.io/api-reference/
  - https://focus.finops.org/focus-specification/v1-3/
billingModel:
  pricingCategory: Consumption-Based + Subscription
  billingFrequency: Annual
  billingCurrency: USD
  chargeCategories:
    - Usage
    - Purchase
    - Tax
    - Adjustment
    - Refund
    - Credit
  chargeFrequency: Recurring
focusColumns:
  ServiceName: Cribl
  ServiceCategory: Observability Pipeline
  ProviderName: Cribl
  PublisherName: Cribl, Inc.
  InvoiceIssuerName: Cribl, Inc.
  PricingCategory: Usage-Based
  BillingCurrency: USD
  ChargeCategory: Usage
meters:
  - name: data_processed
    description: Volume of telemetry data processed through Cribl Stream / Edge per day
    unit: TB
    aggregation: sum
    dimensions:
      - source
      - destination
      - pipeline
      - worker_group
      - environment
  - name: worker_processes
    description: Worker process count concurrently running across worker groups
    unit: worker_process
    aggregation: max
    dimensions:
      - worker_group
      - environment
  - name: edge_nodes
    description: Cribl Edge agents deployed across the fleet
    unit: edge_node
    aggregation: max
    dimensions:
      - fleet
      - environment
  - name: lake_storage
    description: Cribl Lake storage consumed
    unit: GB-month
    aggregation: avg
    dimensions:
      - dataset
      - retention_class
  - name: search_executors
    description: Concurrent Cribl Search executors
    unit: executor
    aggregation: max
    dimensions:
      - workspace
      - environment
  - name: subscription_fee
    description: Annual / monthly subscription baseline tied to the platform tier
    unit: month
    aggregation: max
    dimensions:
      - tier
      - workspace
principles:
  - name: Visibility
    description: Use the Cribl Cloud dashboard, Cribl Search, and per-pipeline metrics to track TB/day
      processed by source, destination, pipeline, and worker group. Export usage telemetry into the
      same observability stack you bill for.
  - name: Allocation
    description: Allocate cost by source system (security, infra, app), destination (SIEM, lake, archive),
      and team. Cribl's pipeline-level metrics make per-team chargeback feasible for shared deployments.
  - name: Optimization
    description: Cribl's core ROI is volume reduction - use Reduce, Suppress, Sample, and Drop functions
      in pipelines to shrink data before downstream-tool ingest cost; route low-value telemetry to
      Cribl Lake instead of premium SIEM ingest; right-size worker process count to match TB/day; use
      Cribl As Code (Terraform / SDK) to enforce the optimization patterns across environments.
  - name: Accountability
    description: Assign each pipeline an owner; alert on TB/day burn-rate at the worker-group level
      so over-budget telemetry sources are caught before a renewal cycle. Tie Cribl ROI metrics (pre-
      vs post-Cribl downstream cost) into FinOps reviews.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com