How do I do a POC? What's a reasonable 30-day test plan for a mid-sized company?

Everyone's rushing to do a Cribl POC without defining what "success" actually means. You'll end up with a shiny dashboard and zero operational value.

Skip the vendor's canned demo. Your 30-day plan should be brutal. First, pick one high-cost, high-noise data source (think cloud audit logs or verbose app telemetry). Define a concrete goal: "Reduce Splunk ingest by 30% for this source" or "Parse and route to three different destinations (S3, Datadog, dead letter) based on these five rules." Then, actually measure the before/after costs and pipeline maintenance overhead. If you can't prove a hard ROI in 30 days on a single use case, imagine the mess at scale.