

Find out in this report how the two Application Performance Monitoring (APM) and Observability solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
What we've seen is really an overall reduction of just shy of 40% in our ingest into our SIM platform versus prior to having Cribl.
The second thing is that data aggregation, sampling, and reduction that we're able to do of the data, lowering our overall data volume, both traversing the network as well as what's being stored inside of our final solutions.
In terms of reduction, we were able to save almost ~40% of our total cost.
They had extensive expertise with the product and were able to facilitate everything we needed.
Usually, within an hour, we get a response, and we are able to work with them back and forth until we resolve the issues.
Sometimes by hearing the problem itself, they will know what the solution is, and they will let us know how to resolve it, and we do it immediately.
They need to work on their response time and overall competence.
The distributor's support is rated an eight out of ten, indicating room for improvement in SLA handling.
I am actually happy with technical support from NETSCOUT.
The infrastructure behind Cribl Search is also scalable as it uses a CPU and just spawns horizontally more instances as it demands and requires.
Compared to other SIEM tools I use, any slight change on the operating system end impacts a lot on our SIEM tools and other things, but Cribl performs well in that regard.
Cribl performs effectively across both market segments.
The solution is highly scalable and accommodates the growth needs effectively.
It is not similar to software solutions Datadog or Dynatrace where they can easily add agents without problems.
Migrating from those SC4S servers to Cribl worker nodes has truly been a game-changer.
Regarding scalability, we started with zero servers and have around 285 servers now.
Cribl is designed to deal with certain kinds of loads and is not designed to handle any scenario in the market.
Datadog is more stable than NETSCOUT nGeniusONE, being a SaaS-based solution compared to on-prem solutions like NETSCOUT.
I rate the stability of NETSCOUT nGeniusONE as ten out of ten since we have not experienced any escalations or downtime issues from the end user's side.
Customers are more sensitive about NETSCOUT nGeniusONE's upgrades because it has hardware.
A more stringent role-based access control feature would enhance security and allow granular control over what users can see and access.
When passing query logs or DNS logs, if certain malicious query patterns need to be identified or if fast-flux attacks are happening, Cribl can report that and those would definitely be a plus for them.
I would advise others looking to implement Cribl that if they are evolving Cribl Search, it would be very interesting to see more capability, more flexibility, and more ways to share the data similar to Splunk.
Customers want to have service assurance, including NPM and APM, from one vendor.
It would be beneficial to see more AI capabilities included in nGeniusONE to further streamline processes.
Many big companies Samsung and Hyundai try to build their own monitoring solutions using open-source tools and their own engineers, though it has not been successful.
Over time, the licensing cost has increased.
It was cheaper than the Splunk license.
Splunk is more expensive, and Cribl appears to be more affordable.
The cost depends on the size of the customer, as sizing controls the pricing.
Regarding its high price, I give NETSCOUT nGeniusONE a seven.
The data reduction and preprocessing capabilities make Cribl really unique.
Cribl has a feature called JSON Unroll or Unroll function that allows you to differentiate the events; each event will come ingested as a single log instead of piling it up with multiple events.
The Cribl UI is very simple and easy to use, particularly when working with data from various sources; it makes it very easy to create pipelines, add complex logic to those pipelines, and then gives you a preview of what your data looks like before applying that pipeline and what you get after.
The capability of real-time traffic intelligence is also very useful because it allows for the comparison between real-time and historical packet levels.
Their analysis capability actually surpasses other APM solutions, which is why customers love it.
NETSCOUT nGeniusPULSE has an easier dashboard to manipulate compared to SolarWinds.
| Product | Mindshare (%) |
|---|---|
| Cribl | 1.1% |
| NETSCOUT Network & Application Observability | 0.8% |
| Other | 98.1% |

| Company Size | Count |
|---|---|
| Small Business | 52 |
| Midsize Enterprise | 8 |
| Large Enterprise | 36 |
| Company Size | Count |
|---|---|
| Small Business | 26 |
| Midsize Enterprise | 13 |
| Large Enterprise | 59 |
Cribl offers a data management approach with its intuitive interface, real-time filtering, and integration capabilities, effectively managing log volumes and ensuring cost-efficient data processing.
Cribl stands out for its capability to manage high volumes of logs and metrics with ease. Its users benefit from real-time data filtering and routing, which enhances data quality and processing efficiency. Cribl integrates with many vendors, enabling seamless data handling and cost reduction by, for example, routing relevant data to platforms like Splunk or Datadog and reducing unnecessary log data to save on SIEM costs. Despite being recognized for its capabilities, concerns about its pricing and the need for improvements in performance during high data volumes, Git integration, and learning resources have been noted.
What are the key features of Cribl?In specific industries, Cribl is implemented for optimizing data ingestion and managing intricate log flows. Companies leverage its capabilities for cost-effective data routing to SIEM systems, ensuring critical information reaches destinations like Splunk or Datadog. Through significant data volume reduction, organizations maintain high operational efficiency.
NETSCOUT Network & Application Observability enhances network operations by offering powerful packet analysis and real-time insights. It transforms raw data into intelligence and simplifies troubleshooting, ensuring effective monitoring across diverse platforms.
NETSCOUT Network & Application Observability delivers comprehensive visibility and interoperability with a single pane of glass to aid in quick troubleshooting and traffic monitoring. It provides real-time insights and metrics that enhance network evaluations, helping transform raw data into actionable intelligence for better performance monitoring across diverse environments. However, it faces challenges like complexity, non-intuitive dashboard setup, and high server requirements. Enhancements in data analysis, visualization, and security features, along with improved integration with other products and detailed alerts, are needed.
What are the key features of NETSCOUT Network & Application Observability?
What benefits do users highlight?
NETSCOUT Network & Application Observability is widely implemented in industries such as telecom and banking for network troubleshooting and application performance management. It helps in monitoring infrastructure, capturing unknown traffic, and managing bandwidth. The tool supports security alerts, real-time communications analysis, and proactive monitoring of remote sites, aiding in efficient network operations and enhanced end-user experience.
We monitor all Application Performance Monitoring (APM) and Observability reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.