Splunk alleges source code theft by former employee who started rival biz

Updated Data-crunching outfit Splunk has filed a lawsuit alleging that a former employee stole its source code and used it to start a rival company.

A Splunk complaint [PDF] names Clint Sharp, a former senior leader in Splunk’s product management team, as the villain of the piece after he founded a rival company called “Cribl”.

“Cribl was founded fourteen years after Splunk by a former Splunk employee, Clint Sharp,” the complaint states, adding: “Mr. Sharp founded Cribl using code he intentionally and unlawfully took from Splunk when he was a Splunk employee without a license or permission to do so.”

The complaint also alleges that Cribl and Sharp “have recruited numerous Splunk employees to Cribl, and have systematically encouraged employees to take Splunk’s confidential technical and business documents with them.”

Splunk alleges Cribl has used stolen documents “to further develop its software and interfere with Splunk’s customer relationships.”

The suit also alleges that Cribl launched in 2018 and joined Splunk’s Technology Alliance Partner Program, even as it launched a product based on Splunk code.

Splunk didn’t spot that, but eventually realised Cribl might not be delivering the expected value-adds to Splunk and could be working against it, so booted it from the Partner Program.

• Splunk dabbles in edgy hardware, lowers data ingestion
• Arm hires former Splunk CFO Jason Child ahead of IPO
• AWS and Splunk partner for faster cyberattack response

At the time of writing, Cribl’s newsroom and social channels include nothing in response to Splunk’s allegations. The Register has asked the company for comment and will update this story if we received a substantive response – but we’re not holding our breath because our message to Cribl’s email address for media inquiries has bounced with a “this address may not exist” error.

Splunk’s complaint seeks an injunction to prevent Cribl’s improper and unauthorized use of Splunk Enterprise and any other Splunk software, plus compensation for having done so, on grounds that Cribl has infringed patents and copyrights and must have known it was doing so.

Splunk has said it will not enact a sanction it could impose by itself - blocking interoperability with Cribl – presumably because for some users that would make Splunk’s own wares less useful. ®

Updated to add at 2150 UTC, October 6

Cribl has issued a statement in which it denies Splunk's allegations.

"The allegations in Splunk’s lawsuit are false, and we will defend against these baseless claims," the company asserts.

"We have built interoperability using our own hard work and open source implementations, such as Eventgen. While Splunk tries to stifle competition through litigation, we will keep our relentless focus on our customers to give them choice and control over their data."