

Cribl and IBM Instana Observability compete in the observability solutions category. Cribl seems to have the upper hand in cost management and data handling abilities, while IBM Instana stands out in real-time analytics and monitoring capabilities.
Features: Cribl offers advanced tools like Cribl Search and Cribl Guard, providing efficient data routing, substantial reduction in firewall log volumes, and seamless integration with various platforms. It handles large data types in real time, making it a top choice for diverse data environments. IBM Instana Observability excels in providing real-time metrics and application monitoring, with strengths in business monitoring that allow detailed system performance insights and facilitate quick resolution of issues through enhanced collaboration between development and operations teams.
Room for Improvement: Cribl could boost cost-effectiveness by integrating more automated analytics and improving debugging and Git integration capabilities. Enhancing training resources and coping with massive data volumes are other suggested improvements. IBM Instana Observability could benefit from adding preventive features, improving customer support, and simplifying its interface to better manage large data volumes, addressing user needs for improved automation features and capacity planning.
Ease of Deployment and Customer Service: Cribl supports flexible deployment options, including on-premises, hybrid, and public cloud environments, with strong customer service noted for response time improvements. IBM Instana Observability also deploys in private and public clouds and supports hybrid environments. However, its interface may slow under large volumes, indicating a need for more streamlined deployment processes and interface simplification.
Pricing and ROI: Cribl is appreciated as a cost-effective alternative to solutions like Splunk due to its substantial data reduction capabilities, leading to significant cost savings and improved ROI, particularly for large enterprises. IBM Instana Observability is often perceived as affordable due to its straightforward pricing model based on hosts, though its value perception varies with usage scale. Despite varying user experiences, both solutions have been credited with improving operational efficiency and cost reductions, with Cribl’s ROI often emphasized for its impact on data processing costs and volume reduction.
What we've seen is really an overall reduction of just shy of 40% in our ingest into our SIM platform versus prior to having Cribl.
The second thing is that data aggregation, sampling, and reduction that we're able to do of the data, lowering our overall data volume, both traversing the network as well as what's being stored inside of our final solutions.
In terms of reduction, we were able to save almost ~40% of our total cost.
It provides a single pane of glass from which I can see what is happening with all the servers in my infrastructure, which saves time.
It made a notable difference from when we were almost blind to being able to respond to calls immediately.
If we have a monitoring tool, we can save our transactions and see the performance of the application using MTTR and MTTD.
They had extensive expertise with the product and were able to facilitate everything we needed.
Usually, within an hour, we get a response, and we are able to work with them back and forth until we resolve the issues.
Sometimes by hearing the problem itself, they will know what the solution is, and they will let us know how to resolve it, and we do it immediately.
They are very slow to respond and integrate new features.
IBM support for Instana is responsive and helpful.
We did have experiences where a significant issue arose during implementation, often involving compatibility problems with JavaScript libraries used by IBM Instana Observability.
The infrastructure behind Cribl Search is also scalable as it uses a CPU and just spawns horizontally more instances as it demands and requires.
Compared to other SIEM tools I use, any slight change on the operating system end impacts a lot on our SIEM tools and other things, but Cribl performs well in that regard.
Cribl performs effectively across both market segments.
More innovations are coming in every day, so it is scalable and more applications are becoming container-based.
IBM Instana Observability demonstrates scalability, especially in dynamic, distributed environments such as microservices and Kubernetes.
Migrating from those SC4S servers to Cribl worker nodes has truly been a game-changer.
Regarding scalability, we started with zero servers and have around 285 servers now.
Cribl is designed to deal with certain kinds of loads and is not designed to handle any scenario in the market.
A more stringent role-based access control feature would enhance security and allow granular control over what users can see and access.
When passing query logs or DNS logs, if certain malicious query patterns need to be identified or if fast-flux attacks are happening, Cribl can report that and those would definitely be a plus for them.
I would advise others looking to implement Cribl that if they are evolving Cribl Search, it would be very interesting to see more capability, more flexibility, and more ways to share the data similar to Splunk.
I had many false positives with IBM Instana Observability. Then I fixed the filters and it became more accurate on the errors reported.
One main issue I found with IBM Instana Observability was the customer support, which was very poor when we needed some features to be enabled or integrated into IBM Instana Observability sensors.
It is not open-source, and I have to be a partner to get more access to the products.
Over time, the licensing cost has increased.
It was cheaper than the Splunk license.
Splunk is more expensive, and Cribl appears to be more affordable.
I find the cost of IBM Instana Observability to be very affordable compared to competitors because the pricing mechanism is based on the host that we monitor, unlike other competitors such as DataDog and Dynatrace, whose pricing is based on other factors.
It is not that costly, especially since we only use two instances.
I think the pricing is good and I do not think it is high.
The data reduction and preprocessing capabilities make Cribl really unique.
Cribl has a feature called JSON Unroll or Unroll function that allows you to differentiate the events; each event will come ingested as a single log instead of piling it up with multiple events.
The Cribl UI is very simple and easy to use, particularly when working with data from various sources; it makes it very easy to create pipelines, add complex logic to those pipelines, and then gives you a preview of what your data looks like before applying that pipeline and what you get after.
IBM Instana Observability has positively impacted my organization by making it easy to observe the entire infrastructure under one platform, which was the biggest advantage of onboarding onto IBM Instana Observability.
IBM Instana Observability has impacted my organization positively in that it has helped me find out what the issue is in real-time because of its one-second granularity and its ability to identify issues as quickly as possible.
With multiple servers and multiple applications, IBM Instana Observability allows us to resolve issues very quickly because we immediately know that a disk is full, the storage is full, or the database is down.
| Product | Mindshare (%) |
|---|---|
| Cribl | 1.1% |
| IBM Instana Observability | 0.7% |
| Other | 98.2% |


| Company Size | Count |
|---|---|
| Small Business | 52 |
| Midsize Enterprise | 8 |
| Large Enterprise | 36 |
| Company Size | Count |
|---|---|
| Small Business | 6 |
| Large Enterprise | 5 |
Cribl offers a data management approach with its intuitive interface, real-time filtering, and integration capabilities, effectively managing log volumes and ensuring cost-efficient data processing.
Cribl stands out for its capability to manage high volumes of logs and metrics with ease. Its users benefit from real-time data filtering and routing, which enhances data quality and processing efficiency. Cribl integrates with many vendors, enabling seamless data handling and cost reduction by, for example, routing relevant data to platforms like Splunk or Datadog and reducing unnecessary log data to save on SIEM costs. Despite being recognized for its capabilities, concerns about its pricing and the need for improvements in performance during high data volumes, Git integration, and learning resources have been noted.
What are the key features of Cribl?In specific industries, Cribl is implemented for optimizing data ingestion and managing intricate log flows. Companies leverage its capabilities for cost-effective data routing to SIEM systems, ensuring critical information reaches destinations like Splunk or Datadog. Through significant data volume reduction, organizations maintain high operational efficiency.
IBM Instana Observability offers real-time metrics, one-second resolution, and integrates alerts with Slack and email, enhancing IT and application monitoring. It aids teams in identifying system issues quickly and effectively, streamlining IT management.
IBM Instana Observability provides a single-vendor solution for seamless observability in distributed environments, integrating one-second resolution metrics, robust application monitoring, and detailed observability maps. Its comprehensive dashboards enhance collaboration by offering real-time insights into infrastructure, traffic flow, and incident tracking. Enhanced tracing and business monitoring help in identifying bottlenecks, improving efficiency. Users can customize dashboards for tailored insights, though some suggest integrating log management and improving interface speed with large datasets. Additional challenges include alerting integration complexity and the need for advanced AI models. Enhancements in reporting, particularly with Cognos, and better support are areas of user feedback.
What features make IBM Instana Observability effective?IBM Instana Observability is widely deployed in monitoring infrastructure and application performance, especially in distributed systems like Kubernetes and OpenShift. It is utilized for insights into microservices management, dynamic communication tracking, and service dependency identification. Popular in academic and consultancy sectors, the tool supports everything from databases to cloud platforms and employs synthetic monitoring to check endpoints effectively.
We monitor all Application Performance Monitoring (APM) and Observability reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.