Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 1 of 85
`
`
`
`
`Frank E. Scherkenbach (CA SBN 142549)
`scherkenbach@fr.com
`Andrew G. Pearson (Pro Hac Vice forthcoming)
`pearson@fr.com
`Adam Kessel (Pro Hac Vice forthcoming)
`kessel@fr.com
`Kevin Su (Pro Hac Vice forthcoming)
`su@fr.com
`Kayleigh E. McGlynn (Pro Hac Vice forthcoming)
`mcglynn@fr.com
`Daniel H. Wade (Pro Hac Vice forthcoming)
`wade@fr.com
`FISH & RICHARDSON P.C.
`One Marina Park Drive
`Boston, MA 02210
`Telephone: (617) 542-5070
`Facsimile: (617) 542-8906
`
`Olivia T. Nguyen (CA SBN 337927)
`onguyen@fr.com
`FISH & RICHARDSON P.C.
`500 Arguello Street, Suite 400
`Redwood City, CA 94063
`Telephone: (650) 839-5070
`Facsimile: (650) 839-5071
`
`
`Attorneys for Plaintiff
`SPLUNK INC.
`
`
`
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`
`
`
`Case No. _______________
`
`Plaintiff,
`
`COMPLAINT
`
`
`
`JURY TRIAL DEMANDED
`
`SPLUNK INC.,
`
`
`
`
`
`v.
`
`
`CRIBL, INC., and CLINT SHARP, an
`individual,
`
`
`
`
`
`
`Defendants.
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`
`
`1
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 2 of 85
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`This is an intellectual property case involving two competing software companies:
`
`Splunk, a pioneer and leader in the data analytics software industry, and Cribl, a business built
`
`on the back of Splunk’s labor and intellectual property, without license and without regard for
`
`ethics, the rights of others, or the law.
`
`Cribl was founded fourteen years after Splunk by a former Splunk employee, Clint Sharp.
`
`Mr. Sharp founded Cribl using code he intentionally and unlawfully took from Splunk when he
`
`was a Splunk employee without a license or permission to do so. Since that time, Cribl and Mr.
`
`Sharp have recruited numerous Splunk employees to Cribl, and have systematically encouraged
`
`employees to take Splunk’s confidential technical and business documents with them. In turn,
`
`10
`
`Cribl has used the information it misappropriated to compete unfairly against Splunk. At the
`
`11
`
`same time, Cribl has developed and marketed its software by making unlicensed copies of
`
`12
`
`Splunk’s copyrighted software, and by willfully infringing the patents that the United States
`
`13
`
`Patent and Trademark Office awarded to Splunk for its foundational innovations. Cribl has
`
`14
`
`attempted to mislead the market into believing that Cribl is an innovator, when in fact Cribl’s
`
`15
`
`“innovation” is derivative of Splunk’s intellectual property.
`
`16
`
`Splunk encourages fair competition, and it embraces the ability of third parties to build
`
`17
`
`software on top of its software platform. Splunk recognizes that innovation by third parties
`
`18
`
`working with Splunk’s software makes the Splunk ecosystem better for everyone—for Splunk’s
`
`19
`
`customers, for Splunk itself, and for other Splunk partners. But Cribl’s unlawful actions are not
`
`20
`
`innovation, and they have no place on the Splunk platform or in our economy. Cribl’s unethical
`
`21
`
`actions, its willful disregard of intellectual property rights, and its coordinated campaign of
`
`22
`
`misappropriation have left Splunk no choice but to file this lawsuit to stop Cribl’s unlawful
`
`23
`
`actions and to seek redress for the damage that Cribl has caused.
`
`24
`
`Plaintiff Splunk Inc. (“Splunk”) files this Complaint against Defendants Cribl, Inc.
`
`25
`
`(“Cribl”) and Clint Sharp and alleges as follows:
`
`26
`
`1.
`
`Splunk develops and operates an industry-leading data platform for analyzing
`
`27
`
`large volumes of machine data. Splunk was founded in 2003, pioneered the machine data
`
`28
`
`analytics industry, and still leads it in both innovation and customer affinity to this day.
`
`
`
`
`
`2
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 3 of 85
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`2.
`
`Cribl is a software company whose products leverage Splunk’s data platform. It
`
`was founded in 2017 by three former Splunk employees. These employees built critical
`
`functionality into Cribl’s first software product by improperly using Splunk source code
`
`intentionally misappropriated from Splunk. As set forth below, since this initial misuse, Cribl
`
`has taken an immense volume of additional confidential material from Splunk and used that
`
`material to compete unfairly against Splunk. Cribl has also developed its products with willful
`
`disregard for Splunk’s patent rights and used Splunk software in a manner that willfully infringes
`
`Splunk’s copyrights.
`
`3.
`
`Cribl’s first product was released in late 2018. At that time, Cribl did not reveal
`
`10
`
`to Splunk that its product was based on misuse of misappropriated Splunk code. Instead, Cribl
`
`11
`
`held itself out as a partner of Splunk. In fact, Cribl joined Splunk’s official Technology Alliance
`
`12
`
`Partner Program under this pretense, branding itself as the partner of a company it actually
`
`13
`
`sought to undermine.
`
`14
`
`4.
`
`Not content with unlawfully taking and misusing Splunk’s code, Cribl also took
`
`15
`
`other confidential material from Splunk, including by soliciting important technical and business
`
`16
`
`documents from departing Splunk employees, and then using those documents to further develop
`
`17
`
`its software and interfere with Splunk’s customer relationships. On information and belief,
`
`18
`
`Cribl’s CEO and co-founder, Clint Sharp, actively participated in this effort, recruiting Splunk
`
`19
`
`employees to join Cribl and encouraging them to bring Splunk confidential material with them.
`
`20
`
`5.
`
`Cribl’s actions led to Splunk terminating Cribl’s status as a Splunk partner. But
`
`21
`
`Cribl has continued to misuse Splunk’s proprietary information and has operated with wanton
`
`22
`
`disregard of Splunk’s patents and copyrights. For example, on information and belief, Cribl has
`
`23
`
`used Splunk’s copyrighted software in conjunction with its software development work and
`
`24
`
`marketing, despite having no license to do so. And the software that Cribl has developed
`
`25
`
`infringes numerous Splunk patents, despite, on information and belief, Cribl’s awareness of the
`
`26
`
`patents and knowledge of its infringement or willful blindness thereof.
`
`27
`
`28
`
`
`
`
`
`6.
`
`Cribl’s course of conduct has left Splunk no choice but to file this lawsuit.
`
`3
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 4 of 85
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`7.
`
`Splunk supports a robust innovation ecosystem around its products because it
`
`believes that fair competition and collaboration on Splunk’s platform will benefit Splunk’s
`
`customers. Accordingly, Splunk encourages third parties—and especially its partners—to
`
`develop software that extends the features and functionality of Splunk’s data platform, pursuant
`
`to its partner programs and while respecting Splunk’s proprietary rights. But Cribl’s actions are
`
`neither innovative nor fair.
`
`8.
`
`Cribl built its business on a foundation of misappropriated and misused Splunk
`
`code and documents, willful infringement of intellectual property, and a disregard of contractual
`
`and ethical obligations and principles of fair competition. While Cribl now markets itself as an
`
`10
`
`“innovator,” and describes Splunk to its employees and customers as “stale,” the reality could
`
`11
`
`not be further from Cribl’s characterizations. Splunk’s innovations are reflected in the well over
`
`12
`
`1,000 patents it has been awarded by the United States Patent and Trademark Office, while
`
`13
`
`Cribl’s “innovation” is reflected in the number of patents it possesses: zero. Since Cribl is
`
`14
`
`unwilling to compete fairly in the market, it must account for its actions in court.
`
`15
`
`16
`
`9.
`
`Plaintiff Splunk is a Delaware corporation with its principal place of business at
`
`THE PARTIES
`
`17
`
`270 Brannan Street, San Francisco, CA 94107.
`
`18
`
`10.
`
`Defendant Cribl is a Delaware corporation with its principal place of business at
`
`19
`
`44 Tehama Street, Suite 201, San Francisco, CA 94105.
`
`20
`
`11.
`
`Defendant Clint Sharp is the CEO and co-founder of Cribl. On information and
`
`21
`
`belief, Mr. Sharp resides in Oakland, CA.
`
`22
`
`23
`
`JURISDICTION, VENUE, AND DIVISIONAL ASSIGNMENT
`
`12.
`
`This Court has original jurisdiction to adjudicate Splunk’s Patent Act, Copyright
`
`24
`
`Act, and Digital Millennium Copyright Act claims pursuant to 17 U.S.C. § 101 et seq., 28 U.S.C.
`
`25
`
`§ 1331, and 28 U.S.C. § 1338(a). This Court has supplemental jurisdiction over the other claims
`
`26
`
`asserted herein pursuant to 28 U.S.C. § 1367 because they are so related to the claims in this
`
`27
`
`action for which the Court has original jurisdiction that they form part of the same case or
`
`28
`
`controversy under Article III of the United States Constitution.
`
`
`
`
`
`4
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 5 of 85
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13.
`
`As set forth above, all Defendants are residents of and/or have a regular and
`
`established place of business in the State of California and this judicial district. In addition, a
`
`substantial part of the events giving rise to the claims alleged in this Complaint occurred in this
`
`judicial district. Venue therefore lies in the United States District Court for the Northern District
`
`of California pursuant to 28 U.S.C. § 1391(b), (c) and (d), as well as 28 U.S.C. § 1400(a) and (b).
`
`14.
`
`On information and belief, a substantial part of the events giving rise to the claims
`
`alleged in this Complaint occurred in the City and County of San Francisco. For purposes of
`
`divisional assignment under Civil L.R. 3-2(c) and 3-5(b), this action involves intellectual
`
`property rights and will be assigned on a district-wide basis.
`
`GENERAL ALLEGATIONS
`
`Splunk’s Technology
`
`15.
`
`Splunk was founded in 2003. Since then, it has pioneered software that captures,
`
`13
`
`indexes, and analyzes large volumes of machine data in real time, allowing users to make use of
`
`14
`
`that data in profound ways. Splunk’s software has applications in diverse fields ranging from
`
`15
`
`information security to manufacturing to business analytics.
`
`16
`
`16. Machine data is data generated by machines and software running on those
`
`17
`
`machines. Modern businesses generate this data constantly in tremendous volumes—software,
`
`18
`
`servers, sensors, mobile devices, factory equipment, and essentially any other digital device are
`
`19
`
`all potential sources of machine data. On its own, this data is not particularly useful—it exists in
`
`20
`
`an overwhelming number of formats, it is not cross-correlated, and it is so voluminous that
`
`21
`
`humans themselves have no way of gaining insights from or reacting to the data in a meaningful
`
`22
`
`fashion. Prior attempts to try to manage such a large volume of varied data were inelegant and
`
`23
`
`inefficient, and could not handle problems unique to “big data” and large computer networks,
`
`24
`
`such as real-time changes, varied inputs, and analyzing data without structure.1 Splunk’s
`
`25
`
`26
`
`27
`
`28
`
`
`1 Big data has been defined as “an accumulation of data that is too large and complex for processing
`by traditional database management tools.” “Big Data,” Merriam-Webster’s Collegiate Dictionary
`(11th ed. 2020). The “big data” problems that Splunk solves include those that are unique to
`complex and massive computer networks.
`
`
`
`
`
`5
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 6 of 85
`
`
`
`
`disruptive vision in 2003 was to bring this diverse data into a single system, index it, and provide
`
`a platform and interface for this data to be searched, analyzed, and acted upon at scale.
`
`17.
`
`Splunk’s flagship product is named Splunk Enterprise, and can be run locally by
`
`Splunk’s customers, or hosted in the cloud by Splunk for its customers (via the Splunk Cloud
`
`Platform). Splunk Enterprise ingests real-time flows of machine data from disparate sources
`
`across a distributed environment and indexes that data, regardless of its source or format.
`
`Customers can then interact with their data through an interface from which they can generate
`
`graphs, reports, alerts, dashboards, and visualizations. Customers can thus use Splunk Enterprise
`
`to monitor and react to their data in real time.
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`18.
`
`Splunk’s software has significantly impacted the way companies across the world
`
`11
`
`use data. Today, Splunk has thousands of customers, including many of the world’s largest and
`
`12
`
`most complex organizations in both the private and public sectors. Splunk not only pioneered
`
`13
`
`the industry in which it now operates, but it continues to lead that industry.
`
`14
`
`19.
`
`Indeed, in 2021, Fortune Magazine selected Splunk as one of the 2021 World’s
`
`15
`
`Most Admired Companies for its highly regarded corporate reputation and continued growth as a
`
`16
`
`software leader. Market reports from Gartner, Omdia Universe, Research in Action,
`
`17
`
`Constellation Research, and others consistently recognize Splunk as a market leader based on the
`
`18
`
`technological capabilities of its software, and for achieving high levels of customer satisfaction.
`
`19
`
`20. Many of Splunk’s innovations are reflected in the well over 1,000 patents issued
`
`20
`
`to it by the United States Patent and Trademark Office, and in Splunk’s nearly 100 U.S.
`
`21
`
`Copyright Registrations. Splunk’s patents cover diverse technological innovations related to
`
`22
`
`many aspects of software in this industry, from parsing rules to data visualization to remote data
`
`23
`
`capture to working with dual-queue systems. Several such technologies are at issue in this case,
`
`24
`
`and related patents are addressed later in this Complaint.
`
`25
`
`21.
`
`Splunk has continuously developed and enhanced its software products for nearly
`
`26
`
`two decades, as reflected in the many versions of its software it has released over the years.
`
`27
`
`These software versions are protected by valid and duly issued U.S. Copyright Registrations.
`
`28
`
`
`
`See, e.g., Exhibit A. For example, the copyright registrations below cover numerous versions of
`COMPLAINT
`Case No._________
`
`6
`
`
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 7 of 85
`
`
`
`
`Splunk Enterprise and related technologies (hereinafter “Splunk Enterprise” is used to refer to
`
`any or all of the below-referenced versions of Splunk Enterprise, whether deployed on premises
`
`or on the Splunk Cloud Platform):
`
`Registered Work:
`Exploring Splunk Search Processing Language
`(SPL) Primer and Cookbook.
`Indexer 1.0 /by Splunk, Inc.
`Indexer 2.0.1 /by Splunk, Inc.
`Indexer 2.1 /by Splunk, Inc.
`Indexer 2.2.
`Splunk Enterprise 1.0.
`Splunk Enterprise 2.0.1.
`Splunk Enterprise 2.1.
`Splunk Enterprise 2.2.
`Splunk Enterprise 3.0.
`Splunk Enterprise 3.1.
`Splunk Enterprise 3.2.
`Splunk Enterprise 3.3.
`Splunk Enterprise 3.4.
`Splunk Enterprise 4.0.
`Splunk Enterprise 4.1.
`Splunk Enterprise 4.2.
`Splunk Enterprise 4.3.
`Splunk Enterprise 5.0.
`Splunk Enterprise 6.0.
`Splunk Enterprise 6.1.
`Splunk Enterprise 6.2.
`Splunk Enterprise 6.3.
`Splunk Enterprise 6.4.
`Splunk Enterprise 6.5.
`Splunk Enterprise 6.6.
`Splunk Enterprise 7.0.
`Splunk Enterprise 7.1.
`Splunk Enterprise 7.2.
`Splunk Enterprise 7.3.
`Splunk Enterprise 8.0.0.
`Splunk Enterprise 8.1.0.
`Splunk Enterprise 8.2.0.
`Splunk Enterprise 9.0.0.
`Splunk Enterprise S2S Tool.
`
`U.S. Copyright Registration:
`TX 7-631-106
`
`TX 7-541-301
`TX 7-548-761
`TX 7-556-414
`TX 7-567-237
`TX 7-659-994
`TX 7-659-825
`TX 7-659-905
`TX 7-710-860
`TX 7-660-059
`TX 7-660-042
`TX 7-660-046
`TX 7-660-053
`TX 7-660-065
`TX 7-659-847
`TX 7-660-037
`TX 7-659-918
`TX 7-659-917
`TX 7-659-915
`TX 7-801-578
`TX 7-918-705
`TX 7-994-799
`TX 8-216-021
`TX 8-284-845
`TX 8-350-486
`TX 8-410-385
`TX-8-545-897
`TX 8-747-518
`TX 8-747-523
`TX 8-749-975
`TX 8-823-041
`TX 9-154-003
`TX 9-154-008
`TX 9-154-016
`TXu 2-335-442
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`
`
`27
`
`28
`
`
`
`
`
`7
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 8 of 85
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`Splunk’s Partner Program
`
`22.
`
`Because different businesses have different types of data and use that data in
`
`different ways, Splunk built Splunk Enterprise to be a customizable software platform. In other
`
`words, Splunk Enterprise provides a flexible foundation upon which dashboards and software
`
`can be built for application- or use case-specific purposes, sometimes referred to as “solutions,”
`
`“apps,” or “add-ons.”
`
`23.
`
`For example, one company might be interested in monitoring the network traffic
`
`of all servers and computers on its computer network for cyber-security purposes. This company
`
`could use Splunk Enterprise to ingest network log data from all of its computers and servers, and
`
`10
`
`customize Splunk Enterprise so that its data analysis, monitoring, and visualization features are
`
`11
`
`catered to security issues—e.g., graphing incoming and outgoing network traffic, and providing
`
`12
`
`alerts for anomalous activities on the network. On the other hand, a different company may seek
`
`13
`
`to use Splunk Enterprise to handle different data for different reasons—e.g., a manufacturing
`
`14
`
`company may use Splunk Enterprise to ingest data from factory equipment to understand
`
`15
`
`mechanical performance and throughput in real time.
`
`16
`
`24.
`
`Splunk itself publishes solutions directed to various such purposes (e.g.,
`
`17
`
`customizations of and extensions to Splunk Enterprise that cater to advanced network threat
`
`18
`
`detection, digital customer experience, cloud monitoring, or manufacturing). Splunk also
`
`19
`
`supports and encourages third parties to develop on top of the Splunk platform in appropriate and
`
`20
`
`lawful ways, extending the features and functionality of the Splunk platform in accordance with
`
`21
`
`their own business needs or those of Splunk’s customers.
`
`22
`
`25.
`
`Indeed, Splunk maintains a Technology Alliance Partner (“TAP”) Program,
`
`23
`
`pursuant to which partners are provided a license to various software development tools and
`
`24
`
`interfaces (such as application programming interfaces, known as “APIs”) and other materials
`
`25
`
`and information in order to develop software that extends the features or functionality of Splunk
`
`26
`
`Enterprise. TAP partners are also granted a limited license to run Splunk Enterprise software for
`
`27
`
`related software development purposes.
`
`28
`
`
`
`
`
`8
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 9 of 85
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`26.
`
`To join the TAP Program, a third party must sign and execute a contract called the
`
`TAP Agreement. See Exhibit B.
`
`27.
`
`The license to Splunk Enterprise provided to Splunk TAP partners under the TAP
`
`Agreement is limited. In relevant part, the license provides TAP partners with “a nonexclusive,
`
`non-transferable, worldwide, non sublicensable license during the Term to download (and make
`
`up to five (5) copies) and use the Splunk software” for only two uses: (1) to “test the Splunk
`
`Software for purposes of developing TAP Extensions”; and (2) to “demonstrate the use of TAP
`
`Extensions with the Splunk Software to actual, potential or prospective Users.” Id., Section 3.3.
`
`Any use of the Splunk Software that is not in accordance with the Agreement is expressly
`
`10
`
`prohibited. Id., Section 4(h).
`
`11
`
`28.
`
`In particular, the TAP Agreement expressly prohibits a host of other activities.
`
`12
`
`For example, the TAP Agreement does not allow TAP partners to: “(a) copy any Splunk
`
`13
`
`Software (except as required to run the Splunk Software and for reasonable backup purposes);
`
`14
`
`(b) modify, adapt, or create derivative works of the Splunk Software; . . . (d) decompile,
`
`15
`
`disassemble or reverse engineer the Splunk Software, or determine or attempt to determine any
`
`16
`
`source code, algorithms, methods or techniques embodied in the Splunk Software, except to the
`
`17
`
`extent expressly permitted by applicable law notwithstanding a contractual prohibition to the
`
`18
`
`contrary; . . . [or] (f) attempt to disable or circumvent any license key or other technological
`
`19
`
`mechanisms or measures intended to prevent, limit or control use or copying of, or access to,
`
`20
`
`any materials included in the Splunk Software.” Id., Section 4.
`
`21
`
`29.
`
`As addressed in greater detail below, Cribl was formerly a Splunk partner
`
`22
`
`pursuant to a TAP Agreement. Prior to its termination, the TAP Agreement granted Cribl
`
`23
`
`permission to use Splunk Enterprise to develop software that extends Splunk Enterprise’s
`
`24
`
`features or functionality.
`
`25
`
`30.
`
`Splunk invests substantial resources into maintaining its TAP program and
`
`26
`
`supporting the work of its partners.
`
`27
`
`28
`
`
`
`31.
`
`For example, Splunk provides software that permits its partners to feed data into,
`
`or retrieve data from, an instance of Splunk Enterprise. Using this software, a Splunk partner
`COMPLAINT
`Case No._________
`
`9
`
`
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 10 of 85
`
`
`
`
`can develop software capable of sending data to, or retrieving data from, an instance of Splunk
`
`Enterprise. This software—known as the “HEC” protocol—reflects Splunk’s commitment to its
`
`partners: HEC is provided by Splunk to allow Splunk partners to develop software that works
`
`with Splunk Enterprise and extends its features and functionality.
`
`32.
`
`Although Splunk provides HEC for third parties to use, Splunk maintains other
`
`aspects of its software as proprietary. One example of such proprietary software is the “S2S”
`
`protocol. S2S stands for “Splunk-to-Splunk,” and this is software that Splunk itself uses to send
`
`data to, or receive data from, Splunk Enterprise and other Splunk software and technologies.
`
`Splunk does not support use of S2S by third parties, does not publish S2S’s source code, and
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`does not document S2S in a manner that facilitates third-party use of this protocol. As discussed
`
`11
`
`in greater detail herein, Splunk has improved the S2S protocol over time, as reflected in the
`
`12
`
`multiple versions of this protocol that Splunk has released.
`
`13
`
`14
`
`Cribl Was Founded to Capitalize on Splunk’s Technology and Success
`
`33.
`
`Defendant Clint Sharp is a former Senior Director of Product Management at
`
`15
`
`Splunk. As a senior Splunk employee, Mr. Sharp had access to a wide array of Splunk
`
`16
`
`proprietary and confidential information, including Splunk’s S2S protocol and code, and played
`
`17
`
`a significant role in Splunk’s technical organization. Before resigning from Splunk, in early
`
`18
`
`2017, unbeknownst to Splunk and without authorization, Mr. Sharp posted a derivation of
`
`19
`
`Splunk’s proprietary and confidential source code for version 3 of the S2S protocol to his
`
`20
`
`personal github webpage (a publicly accessible website for sharing source code). Mr. Sharp
`
`21
`
`named this derived code “go-S2S.”
`
`22
`
`34. Mr. Sharp created go-S2S by copying Splunk’s S2S version 3 protocol source
`
`23
`
`code without authorization to do so and creating a derivation of that code. At the time, Mr.
`
`24
`
`Sharp had access to this proprietary code only by virtue of his work for Splunk, but he did not
`
`25
`
`have authorization to post Splunk’s code on the Internet or to create new software derived from
`
`26
`
`it.
`
`27
`
`28
`
`
`
`35.
`
`Version 3 of Splunk’s S2S protocol source code is covered by Splunk’s valid and
`
`duly issued U.S. Copyright Registrations for Splunk Enterprise identified in Paragraph 21,
`COMPLAINT
`Case No._________
`
`10
`
`
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 11 of 85
`
`
`
`
`above, including, for example, U.S. Copyright Registration TXu 2-335-442, which covers one
`
`implementation of that version of the protocol.
`
`36.
`
`On information and belief, Mr. Sharp derived go-S2S from Splunk’s copyrighted
`
`source code with the intention of using it for his own personal financial gain at a different
`
`company. On information and belief, Mr. Sharp derived go-S2S from at least the code protected
`
`by the above-referenced U.S. Copyright Registrations.
`
`37.
`
`The Splunk S2S version 3 code that Mr. Sharp copied contained Splunk copyright
`
`headers indicating authorship and ownership information, reflecting Splunk’s copyright in and
`
`ownership of this code, but Mr. Sharp removed this information from the derived files that he
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`posted on his personal github page.
`
`11
`
`38.
`
`On March 24, 2017, a few months after his initial copying of Splunk’s source
`
`12
`
`code, Mr. Sharp resigned from Splunk to co-found Cribl with Dritan Bitincka and Ledion
`
`13
`
`Bitincka—both former software architects at Splunk. On information and belief, Mr. Sharp’s
`
`14
`
`plan was to build a business using the code he had taken from Splunk. For example, Mr. Sharp
`
`15
`
`and Cribl sought to capitalize on their access to the S2S version 3 protocol, which until Mr.
`
`16
`
`Sharp’s misappropriation, had been in Splunk’s exclusive control.
`
`17
`
`39.
`
`Cribl was incorporated in May 2017 and released its first software product,
`
`18
`
`“LogStream,” now known as “Stream,” in October 2018. (Hereinafter, both “LogStream” and
`
`19
`
`“Stream” are referred to as “Stream.”)
`
`20
`
`40.
`
`On information and belief, go-S2S, and/or other source code copied or derived
`
`21
`
`from Splunk’s Splunk Enterprise source code, is currently used within Stream and has been used
`
`22
`
`within Stream since its release. On information and belief, Clint Sharp provided this code to
`
`23
`
`Cribl for its use within Stream, and, to this day, has encouraged and induced Cribl’s use of this
`
`24
`
`code. On information and belief, Mr. Sharp has done so with knowledge that go-S2S was an
`
`25
`
`unlicensed derivative of Splunk’s copyrighted S2S version 3 code.
`
`26
`
`41.
`
`On information and belief, each new version of Cribl’s Stream software includes
`
`27
`
`a new copy of this unlicensed derivative of Splunk’s copyrighted S2S version 3 code.
`
`28
`
`
`
`
`
`11
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 12 of 85
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`42.
`
`In or around December 2018, Mr. Sharp added an open-source MIT license to the
`
`go-S2S source code on his personal github webpage, falsely identifying himself as the author
`
`and/or owner of the copyright in the go-S2S code, and falsely providing open-source terms for
`
`use of the go-S2S code, despite its derivation from Splunk’s proprietary source code. In fact,
`
`Mr. Sharp was not the author or owner of the copyright in go-S2S, nor did he have any authority
`
`to license the go-S2S code, which was an unlawful and unlicensed derivation of Splunk’s source
`
`code.
`
`43.
`
`On information and belief, Mr. Sharp added this false license to the go-S2S code
`
`to obscure his own unlawful copying of Splunk’s copyrighted source code.
`
`10
`
`44. Mr. Sharp maintained the go-S2S code online until at least December 2021,
`
`11
`
`thereby distributing a derivation of Splunk’s copyrighted source code to the public and providing
`
`12
`
`the public with false information regarding the copyright authorship and ownership of this code.
`
`13
`
`45.
`
`Cribl’s Stream software is and has been marketed primarily to Splunk customers.
`
`14
`
`Indeed, Cribl relies heavily on its Splunk experience in its advertisements and boasts about its
`
`15
`
`ability to “speak… S2S.” See Exhibit C (excerpts of https://cribl.io/blog/3-ways-logstream-can-
`
`16
`
`improve-your-data-agility/).
`
`17
`
`46.
`
`A primary function of Stream is to filter the data that Splunk customers send to a
`
`18
`
`Splunk Enterprise instance. In essence, Cribl’s Stream sits between a Splunk customer’s sources
`
`19
`
`of machine data and that customer’s Splunk Enterprise instance. Instead of flowing directly
`
`20
`
`from data sources into Splunk Enterprise, data flows into Stream. Stream can then filter this data
`
`21
`
`before it is passed along to Splunk Enterprise, with a goal of reducing the total volume of data a
`
`22
`
`customer adds to its Splunk Enterprise instance.
`
`23
`
`47.
`
`On information and belief, Cribl has used its illicitly obtained support for the S2S
`
`24
`
`version 3 protocol as a means to convince Splunk’s customers to buy software and services from
`
`25
`
`Cribl. On information and belief, Cribl’s ability to get a foothold in the market depended upon
`
`26
`
`its ability to make available and support the S2S version 3 protocol, which it implemented using
`
`27
`
`Splunk’s proprietary source code without authorization.
`
`28
`
`
`
`
`
`12
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 13 of 85
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`48.
`
`For example, by building S2S support into Cribl’s software using misappropriated
`
`Splunk source code, rather than using the authorized HEC functionality that Splunk makes
`
`available to its partners, Cribl facilitated its sales efforts to Splunk’s customers. Splunk had
`
`invested significant resources in creating and facilitating the creation of customer environments
`
`in which Splunk’s customers used the S2S protocol to transmit data to Splunk. Some of these
`
`environments contained a very large number of data source endpoints configured to transmit data
`
`to Splunk Enterprise via S2S. On information and belief, Cribl targeted and continues to target
`
`Splunk customers with S2S environments on the basis of its illicitly obtained S2S support.
`
`49.
`
`For example, on information and belief, Cribl advertised to Splunk customers that
`
`10
`
`it was able to greatly simplify the process of deploying its Stream software to Splunk customers
`
`11
`
`who were already configured to transmit data to Splunk via S2S. According to Cribl, its support
`
`12
`
`for S2S meant that Splunk customers seeking to use Cribl’s software would not need to spend
`
`13
`
`time or money reconfiguring their customer environment to support a non-S2S protocol (such as
`
`14
`
`HEC). Indeed, Cribl advertises to this day that it can “receive data from whatever you [a Splunk
`
`15
`
`customer] already have in place,” including the “S2S protocol.” Exhibit C
`
`16
`
`(https://cribl.io/blog/3-ways-logstream-can-improve-your-data-agility/).
`
`17
`
`50.
`
`On information and belief, Cribl’s illicit support for Splunk’s S2S protocol
`
`18
`
`continues to be an important part of Cribl’s marketing to customers and potential customers. As
`
`19
`
`set forth in greater detail in this Complaint, as of November 9, 2022, Cribl publicly announced
`
`20
`
`that it had added support for version 4 of Splunk’s S2S protocol to its software. Cribl’s public
`
`21
`
`announcement did not, however, advise its customers and potential customers that Cribl has no
`
`22
`
`right or license to version 4 of the S2S protocol. Indeed, on information and belief, the only way
`
`23
`
`in which Cribl could have added support for version 4 of the S2S protocol is by reverse
`
`24
`
`engineering Splunk software or otherwise using Splunk software in contravention of the licenses
`
`25
`
`Splunk makes available for that software, and/or through unlicensed and unauthorized use of
`
`26
`
`confidential Splunk materials including copyrighted source code. This copyrighted source code
`
`27
`
`is covered by Splunk’s valid and duly issued U.S. Copyright Registrations for Splunk Enterprise
`
`28
`
`
`
`
`
`13
`
`COMPLAINT
`Case No._________
`
`

`

`Case 3:22-cv-07611 Document 1 Filed 12/02/22 Page 14 of 85
`
`
`
`
`identified in Paragraph 21 that correspond to the versions of Splunk Enterprise that support S2S
`
`version 4.
`
`Cribl’s Continued Misappropriation and Unlawful Acts
`
`51.
`
`Splunk was initially unaware that Mr. Sharp misappropriated S2S source code in
`
`2017, and permitted Cribl to join Splunk’s TAP Program in 2018.
`
`
`
`
`52. While it was a member of the TAP Program, Cribl held itself out to Splunk as a
`
`
`
`“partner,” while surreptitiously misappropriating critical information from Splunk and seeking to
`
`undermine its reputation a