CriblCon 2025 Recap: 3 Takeaways from the Front Lines of Observability

I spent a few days in National Harbor, just outside Washington, D.C., for CriblCon 2025—and it was impossible not to feel the energy in the room.

From mainstage keynotes to hallway conversations, one message came through loud and clear: teams don’t want to do less with their data—they want to do more.

AI and exploding data volumes are forcing enterprises to rethink how they move, store, and analyze telemetry. The future belongs to architectures built for choice, control, and flexibility.

Here are my three biggest takeaways from seeing it all firsthand.

1. Freedom to Do More

Cribl CEO Clint Sharp captured the tone perfectly during his keynote:

“Cribl Stream is a telemetry pipeline. We pioneered that category. It decouples sources from destinations. It allows you to route data anywhere. It gives you the choice, the control, the flexibility to get the data in the right shape for the right destination. Enrich it. Reduce it. Filter it. Reshape it.”

That message summed up what nearly every customer echoed on stage.

Under Armour untangled years of syslog clusters and Splunk forwarders into a single, version-controlled pipeline—achieving roughly 70% cost savings and total visibility.

Johnson Controls went even further, using Cribl as a neutral data layer to migrate from Splunk to CrowdStrike NG SIEM in six months with zero downtime—now feeding five analytics platforms in parallel.

Cribl proved that when you decouple data movement from analysis, you gain the freedom to do more—to onboard new data, expand coverage, and experiment without breaking budgets or workflows.

That same principle—freedom through decoupling—is what inspired Imply Lumi.

Everywhere I looked at CriblCon, teams were solving how to move data, but still running into the same downstream challenge: once that data landed, it was costly and complex to keep it searchable at scale.

Lumi extends that same decoupling into the query layer. Its event-indexed format stores data up to 5× more efficiently than GZip while keeping it instantly queryable—no rehydration, no extra pipelines, no operational burden.

That efficiency isn’t just about saving money—it’s about unlocking data that was once out of reach.

With Cribl and Lumi, you can now use Splunk for high-volume, cloud-native sources like CloudWatch, CloudTrail, and VPC Flow logs—simply by connecting to the S3 buckets where those logs already live.

Cribl gives you the freedom to bring in more data. Lumi gives you the freedom to keep it—and do more with it.

2. Keep What Works, Expand What’s Possible

If there was one theme that cut through every hallway conversation, it was this: teams are lean, but their ambitions aren’t.

The winners are the ones who simplify without starting over.

At Getty Images, Simon Overbey’s team reduced Splunk ingest by 800 GB/day, offloaded logs to S3, extended retention, and automated ingestion with CI/CD—all without adding headcount.

At Pegasystems, engineers replaced legacy forwarders with Cribl Edge agents and modernized their SIEM, improving visibility and scalability across global teams.

What stood out wasn’t just efficiency—it was continuity. These teams improved performance and scale without changing how they work.

That’s the same idea behind Lumi. You keep your dashboards, queries, and alerts—everything.

No new workflows. No retraining. Just the same experience running faster, at a fraction of the cost.

Cribl made data movement simple. Lumi keeps that simplicity alive downstream—so you can build on what works and expand what’s possible.

3. Open Data, Infinite Potential

AI was everywhere at CriblCon—but the smartest conversations weren’t about algorithms; they were about architecture.

During his keynote, Clint Sharp described what he called the era of agentic telemetry—where autonomous systems continuously analyze logs, metrics, and traces alongside human context.

As he put it:

“AI isn’t coming to replace humans; it’s coming to replace bad architecture.”

That sentiment echoed across every session: AI can only succeed when the underlying data is open, structured, and accessible.

Open data isn’t just about interoperability—it’s about potential.

When telemetry flows freely through open pipelines and lands in open, queryable storage, both people and machines can act on it instantly.

That’s where Imply Lumi completes the picture.

Cribl gives teams control over how data moves; Lumi ensures that data stays accessible once it lands—whether it’s powering dashboards, alerts, or the next generation of AI-driven investigations.

Together, they form the foundation of an observability architecture built not for limits, but for possibilities.

The Big Picture

Walking out of CriblCon 2025, one thing was clear: the era of compromise is ending.

Decoupled pipelines, simplified operations, and open data aren’t about doing less—they’re about unlocking everything teams have been holding back.

Cribl brings freedom to the pipeline. Imply makes that data instantly usable and infinitely scalable.

Watch: Eric Tschetter in conversation with Bradley Chambers of Cribl

In this short interview, Eric Tschetter, CTO and co-creator of Apache Druid, sits down with Bradley Chambers from Cribl to discuss how Imply Lumi fits into the future of observability infrastructure.
They explore:

• How Lumi supports federated search across hot and cold data.
• How Cribl optimizes and simplifies the query path to keep observability stacks efficient.
• Why preserving field structure and metadata through Cribl Stream + Lumi ensures seamless downstream workflows and interoperability.

Together, they represent the architecture modern observability has been waiting for: open, federated, and ready for whatever comes next.

Ready to See How Far Your Data Can Go?

If you’re exploring how to pair Cribl’s pipeline flexibility with a high-performance, cost-efficient query and storage layer, we’d love to show you what’s possible.Book a demo and see how Imply Lumi helps you do more with your data—no migrations, no rehydration, no limits.