4 fields
Searchable in raw tables
source, sourcetype, host, and time. Fleak sets all four
Fleak joins the Databricks startup accelerator. See the announcement
Move Cribl Lake to Splunk Machine Data Lake. Keep history and detections.
Machine Data Lake only lands data that arrives through a supported input such as HEC or a forwarder, so history has to be replayed, not copied. Fleak replays each Cribl Lake dataset with its original event time, source, sourcetype, and host, and keeps detection sources indexed until you cut over.
- Cribl Lake
- Splunk Machine Data Lake
- HEC replay
- Sourcetype mapping
- Dual routing
- Parity checks
60–80%
Index ingest reduction
only what detections use goes to a Splunk index
< 3 min
Mean heal time
when a source drifts in the middle of the migration
Cribl Lake data doesn't move by copy.
It moves by replay.
Machine Data Lake registers data only when it arrives through a supported input. Files written straight to object storage don't land, so every dataset has to be re-sent with metadata Splunk can match on.
History has to be re-sent
Copying Cribl Lake's gzip JSON or Parquet files into storage doesn't create raw tables. Each dataset has to be replayed through HEC, a forwarder, or an OpenTelemetry Collector.
Timestamps can be wrong
When an event reached Cribl Lake without a numeric _time, Cribl's destination stamped the time it was written. Replay those events as-is and they carry the write time, not the time they happened.
Detections run on indexes
Raw search filters only on source, sourcetype, host, and time. Correlation searches and data models need an index, and streaming promotion doesn't backfill.
A migration path for every dataset,
and every detection.
Fleak replays history and reroutes live sources into Machine Data Lake, with the metadata Splunk matches on and an index for what detections need.
Read every Cribl Lake dataset
Read bring-your-own-storage buckets on Amazon S3 or Azure directly, or take Cribl's own replay from the Lake Collector or Search send.
Event time restored
Fleak re-derives each event's time from the raw event, so replays land on the day things happened, not the day they were written.
Splunk metadata on every event
Source, sourcetype, and host are set per event type and the original _raw is kept, so landing definitions match and Splunk add-ons still parse each sourcetype.
Replayed over HEC, in windows
Fleak sends to the HEC token for each raw table in time windows with backpressure. Direct HEC landing needs no Ingest Processor pipeline.
Land, index, or both
Choose a route for each source. Detection sources stay in a Splunk index, so correlation searches keep running from day one.
Live sources rerouted
Point sources at Fleak once. They land in the lake and the index in parallel while Cribl Stream winds down.
Parity by sourcetype
Compare event counts per sourcetype, host, and day between Cribl Lake and Machine Data Lake before you retire a dataset.
Drift repaired mid-migration
If a source changes format during the cutover, Fleak detects it and repairs the mapping in minutes.
Cut over, or roll back, by source
Retire each Cribl Lake dataset only after parity holds. Rolling back is switching the route back.
Replay one small, old slice first.
Check timestamps, sourcetypes, and retention in Machine Data Lake before the full backfill.
From Cribl Lake to Machine Data Lake,
in four steps.
01 / Inventory datasets
List each Cribl Lake dataset with its format, storage location, retention, partitions, and size, and the routes that feed it.
02 / Map to Splunk
Set source, sourcetype, and host for each event type, and choose land, index, or both for every source.
03 / Replay and dual-route
Replay history over HEC in time windows while live sources land in the lake and detection sources stay indexed.
04 / Cut over on parity
Compare counts per sourcetype, host, and day, and retire each Cribl Lake dataset once they match.
The Brain maps.
The Muscle replays.
The Brain reads samples from each dataset and works out the event type, timestamp, sourcetype, and host, then plans where each event belongs. The Muscle replays every event deterministically over HEC, with backpressure.
Works with
- Cribl Lake
- Cribl Stream
- Cribl Search
- Splunk HTTP Event Collector
- Splunk Machine Data Lake
- Splunk Cloud Platform
A year of firewall logs sits in a Cribl Lake dataset.
Where does each event go?
Splunk index
DetectionsDeny and threat events go to an index, so correlation searches and data models keep running.
Machine Data Lake
RetentionThe full year lands in a raw table with its sourcetype and original timestamps, ready to search or promote.
Parity check
Before cutoverDaily counts per sourcetype match Cribl Lake before the dataset is retired.
Replay history, keep detections indexed, and retire Cribl Lake one dataset at a time.
"A lake migration is a metadata migration. Get the sourcetype and the timestamp right, and everything downstream keeps working."
Lake migration · Fleak Platform
FAQ
Frequently asked questions
Can I copy Cribl Lake files straight into Machine Data Lake?
No. Splunk's documentation says data written directly to object storage doesn't land in Machine Data Lake. Data has to arrive through a supported input such as HEC, a forwarder, or an OpenTelemetry Collector, so history is replayed.
Where is Splunk Machine Data Lake available?
Splunk announced general availability on August 4, 2026, for Splunk Cloud Platform in US-East, Frankfurt, Tokyo, and Sydney. Splunk's service details list it on AWS except GovCloud regions, and not currently on Google Cloud or Azure. It's documented only for Splunk Cloud Platform, not Splunk Enterprise, so confirm the region and entitlement for your stack.
Will my detections work on data in Machine Data Lake?
Raw tables are storage-optimized, and raw search filters only on source, sourcetype, host, and time. Correlation searches and data models run on indexes, so Fleak keeps detection sources indexed and lands the rest in the lake. Splunk can also promote lake data to an index from the Catalog, but streaming promotion doesn't backfill and each promotion creates a new index.
Do replayed events keep their original timestamps?
Yes. Fleak re-derives each event's time from the raw event before sending it. That matters for Cribl Lake data, because the Cribl Lake destination stamps the write time on events that arrive without a numeric time. Test retention on a small, old slice first, since Splunk doesn't document whether raw-table retention counts from event time or landing time.
How does Fleak read Cribl Lake data?
If a dataset lives in a bring-your-own-storage bucket on Amazon S3 or Azure, Fleak reads the bucket directly. If it lives in Cribl-managed storage, Cribl's Lake Collector or Search send replays it to Fleak. Either way, Fleak shapes the events and lands them in Machine Data Lake.
What does landing data in Machine Data Lake cost?
Splunk's licensed-capacity terms include landing and retaining up to 10 TB in Machine Data Lake for Splunk Cloud Platform on AWS, and capacity beyond that is bought as add-on capacity. Splunk doesn't publish a per-GB price, so price the full backfill with your Splunk team before you start.
Do I still need Cribl Stream after the migration?
No. Fleak collects, normalizes, and routes sources into Splunk directly. Keep Cribl running until the last dataset is replayed and parity holds, then retire it.
Splunk Machine Data Lake details come from Splunk's documentation, blog, product page, Splunk Cloud Platform service details, and licensed-capacity terms. Cribl Lake details come from Cribl's documentation. Both as of October 2026. Product names and trademarks belong to their owners.
Bring one Cribl Lake dataset.
30-minute working session. We'll replay a slice into Machine Data Lake and check timestamps and sourcetypes with you.
Explore Related
Run both SIEMs, cut over by source
Every source dual-shipped from one pipeline.
See Detail →Store it cheap, replay it when it matters
A full-fidelity archive, replayed through the same pipeline.
See Detail →OCSF tables in your lake on arrival
Databricks, Snowflake, BigQuery, ClickHouse, and S3.
See Detail →