Our three-year Cribl Stream license is coming up for renewal soon, and I'm starting to prep for the conversation with our account rep. We've been heavy users—ingesting data from a dozen cloud services into our Splunk Cloud and Snowflake instances, with a lot of transformation and routing logic in place. The value is definitely there, but the sticker shock on the initial quote was real.
I'm looking for advice from anyone who's been through a renewal. Specifically:
* What metrics or usage data should I have ready to demonstrate our value (or potentially argue for a better rate)? Is it purely volume-based, or do they care about number of sources/destinations, worker nodes, or features used?
* Are there specific cost drivers in their pricing model that are most negotiable? For example, is there flexibility around committed vs. burst usage tiers?
* Any success stories with bundling Cribl Stream and LogStream Edge, or tying in Cribl Search?
* Timing-wise, is it better to start these talks very early, or is there a known "sweet spot" closer to the expiry date?
Our current setup handles about 2 TB/day, and we're using several Packs (like the Azure Event Hub and S3 sources) and a good bit of custom JavaScript in our pipelines. I'm hoping to keep functionality while optimizing cost.
What has your experience been? Any pitfalls to avoid or levers to pull that I might be missing?
Good place to start. For metrics, gather more than just daily volume. Have your peak throughput and sustained average ready. They often price on potential capacity, not just what you use daily. Count those worker nodes and any plans to add more geo locations - that's leverage.
On negotiable cost drivers, absolutely push for a committed tier that matches your actual sustained use, not the theoretical max. Our last renewal came down 22% when we provided 90 days of dashboards showing we never touched the burst tier they'd sized us for.
Start the talks now. Gives you time to subtly float alternatives if they play hardball. Have you done a build-vs-buy analysis for your core pipelines? Even a rough one changes the tone.
Cloud costs are not destiny.