Splunk Inc. v. Cribl, Inc.

N.D. California

Splunk Inc. v. Cribl, Inc.

District Court, N.D. California·Decided March 17, 2023·No. 3:22-cv-07611·Unknown

Opinion

NORTHERN DISTRICT OF CALIFORNIA

Plaintiff, No. C 22-07611 WHA

v.

CRIBL, INC. and CLINT SHARP, ORDER RE MOTION TO DISMISS Defendants.

In this intellectual property dispute, alleged infringers move to dismiss patent and copyright claims. For the following reasons, the motion is GRANTED IN PART and DENIED IN Patent and copyright owner Splunk Inc. was founded in 2003 and runs a platform for analyzing large volumes of data. Its flagship product, Splunk Enterprise, “ingests real-time flows of machine data from disparate sources across a distributed environment and indexes that data, regardless of its source or format.” This allows customers to “interact with their data through an interface from which they can generate graphs, reports, alerts, dashboards, and visualizations,” and “monitor and react to their data in real time” (Compl. ¶¶ 1, 17). Splunk Enterprise is customizable. Recognizing that customers use different types of data in different ways, Splunk “supports and encourages third parties to develop on top of the Splunk platform,” “extending the features and functionality.” Through its Technology Alliance Partner (“TAP”) program, Splunk grants partners a license to use its software development tools and a limited license to run Splunk Enterprise software for related development (Compl. ¶¶ 22, 24–25). According to Splunk, some Splunk software is specifically provided for partners to use, such as the “HEC” protocol, which enables partners to send data to, or receive data from, a running copy or “instance” of Splunk Enterprise. Other Splunk software is apparently proprietary, such as the “S2S” or “Splunk-to-Splunk” protocol, which Splunk uses to send data to, or receive data from, Splunk Enterprise and other Splunk software. Splunk alleges that it “does not support use of S2S by third parties, does not publish S2S’s source code, and does not document S2S in a manner that facilitates third-party use of this protocol” (Compl. ¶¶ 31–32). Alleged infringer Cribl, Inc. was founded in 2017 by three former Splunk employees, including alleged infringer and Cribl CEO Clint Sharp. In 2018, Cribl launched its first product, now known as Stream, and joined the TAP program by entering into a TAP agreement with Splunk. Stream and other Cribl products interoperate with Splunk Enterprise. As explained by Splunk with respect to Stream, “Stream sits between a Splunk customer’s sources of machine data and that customer’s Splunk Enterprise instance. Instead of flowing directly from data sources into Splunk Enterprise, data flows into Stream. Stream can then filter this data before it is passed along to Splunk Enterprise, with a goal of reducing the total volume of data a customer adds to its Splunk Enterprise instance” (Compl. ¶¶ 2–3, 39, 46, 51). In November 2021, Splunk terminated Cribl’s membership in the TAP program, thereby terminating the TAP agreement. Roughly one year later, it filed an 85-page complaint against Cribl and CEO Sharp alleging patent infringement, copyright infringement, and other unfair business practices. According to Splunk, Cribl has infringed patents awarded to Splunk for its foundational innovations, developed and marketed its software by making unlicensed copies of against Splunk. Meanwhile, CEO Sharp “actively participated” in the misappropriation. Among other actions, he purportedly posted a derivative of Splunk’s copyrighted source code — “go-S2S” — to his personal webpage on code hosting platform GitHub before leaving Splunk to found Cribl with this source code, replacing Splunk’s copyright headers with a false open-source license to obscure unlawful copying before taking the code offline in December 2021 (Compl. ¶¶ 2, 4, 33–37, 42–44, 67; see generally Compl. ¶¶ 119–338). Cribl and CEO Sharp (together, “alleged infringers”) now move to dismiss patent and copyright claims under Rule 12(b)(6) of the Federal Rules of Civil Procedure. Specifically, they move to dismiss: (1) all claims for willful and indirect patent infringement against Cribl; (2) all claims for patent infringement against Cribl based on ineligibility of all asserted patents; (3) all claims for indirect copyright infringement against Cribl and CEO Sharp; and (4) a claim for violation of the Digital Millennium Copyright Act Section 1202 against CEO Sharp. The claims will be taken up in turn. This order follows full briefing and oral argument. To survive a motion to dismiss, a complaint must plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 570). At the pleading stage, a district court “accept[s] all factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005). A “legal conclusion couched as a factual allegation,” however, may be disregarded. Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 555). 1. WILLFUL AND INDIRECT PATENT INFRINGEMENT. Splunk alleges that Cribl committed willful patent infringement and both forms of indirect patent infringement (induced and contributory infringement) of all five asserted patents: U.S. Patent Nos. 9,208,206; 9,762,443; 10,805,438; 10,255,312; and 9,838,467. According to alleged infringers, Splunk’s willful and indirect infringement claims against Cribl should be dismissed because Splunk has not pleaded that Cribl had pre-suit knowledge of the asserted patents, let alone pre-suit knowledge of their infringement. Alleged infringers emphasize that Splunk has failed to assert that it sent Cribl a notice letter, much less that anyone at Cribl was personally aware of the asserted patents. Instead, Splunk “merely implies” that Cribl gained knowledge of the asserted patents because its co-founders and some of its employees previously participated in Splunk’s patent program (Br. 1). According to alleged infringers, this is insufficient when “general knowledge of a patentee’s portfolio does not plausibly allege actual notice of a particular patent” (Br. 1–2). Splunk counters that it has alleged pre-suit knowledge not based on general knowledge of a patent portfolio but rather “extensive factual allegations,” such as: (1) Cribl was founded by ex-Splunkers who managed Splunk software products that practice the patents Cribl infringes (e.g., Compl. ¶¶ 89–93, 116–118); (2) this software is marked as practicing the asserted patents (id. ¶ 114); (3) Cribl has been a customer/user of the software since it was founded (id. ¶¶ 22–29; 69–78); (4) Cribl copied this software (id. ¶ 118); and (4) [sic] Cribl’s founders and employees were aware of Splunk’s patent- marking page when it copied and used this software (id. ¶¶ 116– 118). (Opp. 22–23). This order agrees with alleged infringers that such allegations are too attenuated to support a showing of pre-suit knowledge. To establish willful infringement, a patent owner must prove knowledge of the asserted patents and knowledge of their infringement. Although the jury decides willfulness, willfulness only goes to the jury if it was properly framed by the pleadings. Seeing that no additional pleading requirements have been expounded since the legal standard for willful infringement was clarified in Halo Electronics, Inc. v. Pulse Electronics, Inc., 579 U.S. 93 (2016), know

Free access — add to your briefcase to read the full text and ask questions with AI

NORTHERN DISTRICT OF CALIFORNIA

Plaintiff, No. C 22-07611 WHA

v.

CRIBL, INC. and CLINT SHARP, ORDER RE MOTION TO DISMISS Defendants.

In this intellectual property dispute, alleged infringers move to dismiss patent and copyright claims. For the following reasons, the motion is GRANTED IN PART and DENIED IN Patent and copyright owner Splunk Inc. was founded in 2003 and runs a platform for analyzing large volumes of data. Its flagship product, Splunk Enterprise, “ingests real-time flows of machine data from disparate sources across a distributed environment and indexes that data, regardless of its source or format.” This allows customers to “interact with their data through an interface from which they can generate graphs, reports, alerts, dashboards, and visualizations,” and “monitor and react to their data in real time” (Compl. ¶¶ 1, 17). Splunk Enterprise is customizable. Recognizing that customers use different types of data in different ways, Splunk “supports and encourages third parties to develop on top of the Splunk platform,” “extending the features and functionality.” Through its Technology Alliance Partner (“TAP”) program, Splunk grants partners a license to use its software development tools and a limited license to run Splunk Enterprise software for related development (Compl. ¶¶ 22, 24–25). According to Splunk, some Splunk software is specifically provided for partners to use, such as the “HEC” protocol, which enables partners to send data to, or receive data from, a running copy or “instance” of Splunk Enterprise. Other Splunk software is apparently proprietary, such as the “S2S” or “Splunk-to-Splunk” protocol, which Splunk uses to send data to, or receive data from, Splunk Enterprise and other Splunk software. Splunk alleges that it “does not support use of S2S by third parties, does not publish S2S’s source code, and does not document S2S in a manner that facilitates third-party use of this protocol” (Compl. ¶¶ 31–32). Alleged infringer Cribl, Inc. was founded in 2017 by three former Splunk employees, including alleged infringer and Cribl CEO Clint Sharp. In 2018, Cribl launched its first product, now known as Stream, and joined the TAP program by entering into a TAP agreement with Splunk. Stream and other Cribl products interoperate with Splunk Enterprise. As explained by Splunk with respect to Stream, “Stream sits between a Splunk customer’s sources of machine data and that customer’s Splunk Enterprise instance. Instead of flowing directly from data sources into Splunk Enterprise, data flows into Stream. Stream can then filter this data before it is passed along to Splunk Enterprise, with a goal of reducing the total volume of data a customer adds to its Splunk Enterprise instance” (Compl. ¶¶ 2–3, 39, 46, 51). In November 2021, Splunk terminated Cribl’s membership in the TAP program, thereby terminating the TAP agreement. Roughly one year later, it filed an 85-page complaint against Cribl and CEO Sharp alleging patent infringement, copyright infringement, and other unfair business practices. According to Splunk, Cribl has infringed patents awarded to Splunk for its foundational innovations, developed and marketed its software by making unlicensed copies of against Splunk. Meanwhile, CEO Sharp “actively participated” in the misappropriation. Among other actions, he purportedly posted a derivative of Splunk’s copyrighted source code — “go-S2S” — to his personal webpage on code hosting platform GitHub before leaving Splunk to found Cribl with this source code, replacing Splunk’s copyright headers with a false open-source license to obscure unlawful copying before taking the code offline in December 2021 (Compl. ¶¶ 2, 4, 33–37, 42–44, 67; see generally Compl. ¶¶ 119–338). Cribl and CEO Sharp (together, “alleged infringers”) now move to dismiss patent and copyright claims under Rule 12(b)(6) of the Federal Rules of Civil Procedure. Specifically, they move to dismiss: (1) all claims for willful and indirect patent infringement against Cribl; (2) all claims for patent infringement against Cribl based on ineligibility of all asserted patents; (3) all claims for indirect copyright infringement against Cribl and CEO Sharp; and (4) a claim for violation of the Digital Millennium Copyright Act Section 1202 against CEO Sharp. The claims will be taken up in turn. This order follows full briefing and oral argument. To survive a motion to dismiss, a complaint must plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 570). At the pleading stage, a district court “accept[s] all factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005). A “legal conclusion couched as a factual allegation,” however, may be disregarded. Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 555). 1. WILLFUL AND INDIRECT PATENT INFRINGEMENT. Splunk alleges that Cribl committed willful patent infringement and both forms of indirect patent infringement (induced and contributory infringement) of all five asserted patents: U.S. Patent Nos. 9,208,206; 9,762,443; 10,805,438; 10,255,312; and 9,838,467. According to alleged infringers, Splunk’s willful and indirect infringement claims against Cribl should be dismissed because Splunk has not pleaded that Cribl had pre-suit knowledge of the asserted patents, let alone pre-suit knowledge of their infringement. Alleged infringers emphasize that Splunk has failed to assert that it sent Cribl a notice letter, much less that anyone at Cribl was personally aware of the asserted patents. Instead, Splunk “merely implies” that Cribl gained knowledge of the asserted patents because its co-founders and some of its employees previously participated in Splunk’s patent program (Br. 1). According to alleged infringers, this is insufficient when “general knowledge of a patentee’s portfolio does not plausibly allege actual notice of a particular patent” (Br. 1–2). Splunk counters that it has alleged pre-suit knowledge not based on general knowledge of a patent portfolio but rather “extensive factual allegations,” such as: (1) Cribl was founded by ex-Splunkers who managed Splunk software products that practice the patents Cribl infringes (e.g., Compl. ¶¶ 89–93, 116–118); (2) this software is marked as practicing the asserted patents (id. ¶ 114); (3) Cribl has been a customer/user of the software since it was founded (id. ¶¶ 22–29; 69–78); (4) Cribl copied this software (id. ¶ 118); and (4) [sic] Cribl’s founders and employees were aware of Splunk’s patent- marking page when it copied and used this software (id. ¶¶ 116– 118). (Opp. 22–23). This order agrees with alleged infringers that such allegations are too attenuated to support a showing of pre-suit knowledge. To establish willful infringement, a patent owner must prove knowledge of the asserted patents and knowledge of their infringement. Although the jury decides willfulness, willfulness only goes to the jury if it was properly framed by the pleadings. Seeing that no additional pleading requirements have been expounded since the legal standard for willful infringement was clarified in Halo Electronics, Inc. v. Pulse Electronics, Inc., 579 U.S. 93 (2016), knowledge of the asserted patents and knowledge of their infringement should be pleaded with plausibility. Sonos, Inc. v. Google LLC, 591 F. Supp. 3d 638, 643 (N.D. Cal. 2022), leave to appeal denied, 2022 WL 1486359 (Fed. Cir. May 11, 2022). Because both forms of indirect infringement also require such knowledge, the “foregoing ground rules parallel issues for indirect infringement.” Id. at 647. In other words, knowledge of the asserted patents and knowledge of their infringement should be pleaded with plausibility for indirect infringement claims as well. Prior orders have explained the need for a notice letter in almost all circumstances. See id. at 643–44; Sonos, Inc. v. Google LLC, 2022 WL 2046828, at *3 (N.D. Cal. June 7, 2022); MasterObjects v. Amazon.com, Inc., 2021 WL 4685306, at *7 (N.D. Cal. Oct. 7, 2021). The practice of establishing pre-suit knowledge through a cease-and-desist letter that calls out patent claims and how accused products infringe should be encouraged to give an alleged infringer a meaningful opportunity to cease infringement or get a license before a lawsuit commences. (That such a letter may provoke a declaratory relief suit in a district of that alleged infringer’s choosing does not excuse the failure to send one.) Although there are circumstances in which pre-suit knowledge is properly alleged despite the absence of a notice letter, “the complaint will generally not be adequate to serve as notice for either willful or indirect infringement.” Sonos, 591 F. Supp. 3d at 648. Such is the case here. That Cribl was founded by ex-Splunkers who once managed products which practice patents Cribl allegedly infringes does not give rise to a plausible inference that Cribl’s founders were aware of the five specific asserted patents and that they were infringing them. This knowledge would be above and beyond what could reasonably be expected of senior technical employees — at least when they were not named inventors of the asserted patents. Similarly, that Splunk software directed those who used it to a patent- marking webpage listing Splunk patents and corresponding Splunk products does not give rise to a plausible inference that Cribl’s founders or employees were aware of the five specific asserted patents and that they were infringing them. The implication seems to be that these individuals would affirmatively investigate which of over 1,000 Splunk patents their Splunk software practiced even though Cribl had received a license to use that Splunk software pursuant to the TAP agreement. Again, this is untenable. It is especially untenable upon review of the patent-marking webpage, excerpts of which are provided below (Compl. Exh. P). 1 under ““Splunk® Apps,” and one patent-in-suit is listed under “Splunk® Technology.” They 2 are highlighted for ease of reference. 3 4 Splunk® Enterprise 10,073,454, 10,019,226, 10,019,496, 10,0397,.351, 10,049,473, 10,055,086, 10,067,626, 10,061,807, 10061 821, 10,061,824, 10,067,876, 5 10,067 44, 10,069,972, 10,083,190, 10,091 358, 10,095,397, 10,005,741, 10,108,403, 10,174,663, 10.1027 258, 10,193,805, 10,139,997, 10,142,412, 10,152,773, 10,162,863, 10,164,994, 10,169,405, 10,169,434, 10,178,152, 10,185,708, 10,185,740, 10,193,916, 10,209,842, 6 10,204,093, 10,204,792, 10,216,799, 10216,862, 10,223,423, 10,229,826, 10,225,196, 10,229,150, 10296.221, 10,295,545, 10,255,409, 10,235,418, 10,255,431, 10,235,460, 10235,804, 10,242,099, 10242,0660, 10,242,109, 10,245,818, 10244,1 14, 10,255,310, Mai) 10,255,422, 10,261,673, 10,266,652, 10,268,755, 10,282,455, 10,282,463, 10,296,616, 10,903,544, 10,310,708, 10,318,3960, 10,918,535, 7 TOS 18,537, 10,318,541, 105918553, 10318555, 10 320,877, 10924, 957, 10,326,583, 10,921,720, 10,399,149, 10,399,162, 1,346,957, 10,959,957, 10,962,041, 10,972,722, 10,375,098, 10,979,095, 10,380,122, 10,987,996, 10,987,429, 10,307,448, 10,988,067, 10,994,002, 8 10,394,046, 10402 384, 10,403,041, 10409794, 10,419,404, 10,429,595, 10,444,956, 10,459,938, 10459999, 10460255, 10,460,579, 10,467,263, 10474674, 10,474,682, 10.496,605, 10496, 991, 10,509,698, 10,505,084, 10,500,555, 10.509. 784, 10,500, 794, 10,575,469, 10,529,830, 10,528,607, 10,534,791, 10,596,356, 10,540,921, 10,545,798, 10,545,964, 10,552,726, 10,558,614, 10,555,654, 10,565,196, 9 10,565,220, 10,572,611, 10,5 Po ,007, 10.5 79.048, 10,585,051, 10,555,990, 10,585,019, 10,592,094, 105045 10,599,505, 10,006,810, 10,606,856, 10,606,887, 10,607,150, 10,614,132, 10,642,052, 10,650,069, 10,656,924, 10,657,146, 10,659,609, 10,478,696, 10,678,767, 10 10,675,803, 10,079,142, 10,685,001, 10685279, 10,086,394, 10,693,145, 10,098,777, 10,690,095, 1O.698.697, 10,098,900, 10,705,695, 10,713,245, 10,713,269, 10,713,914, 10,719,493, 10,719,525, 10,725,676, 10,726,030, 10,726,037, 10,726,354, 10,726,589, 10,735,492, 10,740,919, 10,740,970, 10,747,742, 10,748,290, 10,761,687, 10,762,081, 10,762,097, 10,760,786, 10,768,798, 10,769,178, 10,776,194, 1 1 10,776,950, 10,778,710, 10,776,961, 10,769,318, 10,783,324, 10,995,555, 10,798,148, 10,802, 797, 10810221, 10,810,791, 10,810,796, 10,812,514, 10,917,544, 10,817,757, 10,898,605, 10,846,916, 10,859,082, 10,853,500, 10,853,982, 10,859,209, 10,853,999, 10,855,712, x 12 10,855,793, 10,660,537, 10,660,591, 10,860,592, 10,860,624, 10,661,202, 10,666,994, 10,877,969, 10.677 S86, 10,87 7987, 10,665,026, 10,655,125, 10,887,320, 10,891,281, 10.891 284, 10,696,195, 10,896,182, 10,901,811, 10,908,987, 10.909.140, 10,900,151, 10,915,583, 10,929,163, 10,929,560, 10,996,643, 10.042 774, 10,949,419, 10,956,278, 10,956,481, 10,956,024, 10,977,293, 10,977,206, 10,999,786, L& 13 10,984,013, 10,985,970, 10,997,138, 10,997,191, 11,003,337, 11,005,044, 11,003,675, 11,003,682, 11,003,687, 11,003,691, 11,010,214, = 11,070,990, 11,010,412, 141,070,970, 11,076,821, 11,090,173, 11,090,192, 11,090,254, 11,036,566, 11,096,567, 11,097,942, 11,042,510, 14 11,042,575, 11,042,599, 11,042,545, 11,042,591, 11,042,697, 11,055,300, 11,061,918, 11,062,016, 11,068,323, 11,068,452, 11,074,216, gy 11,074,289, 11,075,825, 11,087,236, 11,099,476, 11,093,897, 11,095,690, 11,100,150, 11,106,601, 11,106,713, 11,113,942, 11,119,728, © 14,119,899, 11,719,902, 14,120,944, 11,126,477, 19,199,194, 14,198,210, 11,144,521, 11,144,520, 11,144,608, 11,151,085, 11,151,137, 15 11,157,446, 11,759,397, 11,163,599, 11,169,738, 17,170,016, 11,770,129, 11,172,065, 11,176,146, 11,182,367, 11,184 467, 11,158,550, 11,789,083, 17,790,422, 11,194,794, 11200246, 11,204,817, 11,270,072, 11,2710325, 11,276,591, 11,222,014, 11,226,977, 11227,208, 11,231,840, 11,252,124, 11,232,146, 11,258,035, 11,298,057, 11,244,247, 11,249,710, 11,249,971, 11,250,068, 11,262,224, 11,269,476, A 16 11,269,808, 11,208,291, 11,286,289, 11,294,559, 11,906,064, 11,310,373, 11,914,793, 11,914,744, 11,314,758, 11,914,759, 11,914,761, 44,514,799, 17,516,902, 14,924,911, 11,941,129, 11,947,577, 11,947,695, 11,948,204, 171,949,947, 11,254,206, 17,994,965, 11,975,071, a 17 11,379,479, 11,579,508, 11,979,630, 11,366,109, 11,566,195, 11,992,590, 11,392,604, 11,994,767, 11,409,395, 11,409,758, 11,471,804, 14,422,874, 11,423,216, 17,429,608, 7,937,344, 9,112,425, 6,412,696, 8,575,969, 9,576,008, 6,548,961, 6,566,336, 9,583,631, 8,589,204, oO 8,580,921, 8,589 375, 8,509,403, 6,599,432, 8,589,876, 8,682,856, 6,682,006, 8,602,925, 6,694,450, 6,745,109, 8,751,499, 8,751,529, 18 8,751,963, 8,756,262, 9,756,593, 8,756,614, 8,788,459, 8,788,525, 8,788,526, 6,825,664, 8,904,389, 8,909,642, 8,943,056, 8,972,992, 8,977,638, 8,983,994, 8,990,784, 8,990,245, 9,002 854, 9,075,716, 9,091,955, 9,047,246, 9,087,090, 9,124,012, 9,128,779, 9,128,916, 19 9,128,980, 9,128,985, 9,129,028, 9,129,041, 9,190,971, 9,142,049, 9,162,682, 9,162,929, 9,160,798, 9,177,002, 9,185,007, S208 206, 9,229,985, 9,245,039, 9,256,507, 9,280,594, 9,292,590, 9,296,805, 9,317,582, 9,361,357, 9,384,261, 9,417,774, 9,419,870, 9,426,045, 9,430,485, 9,490,574, 9,497,022, 9,442,987, 9,600,765, 9,614,175, 9,582 557, 9,582,585, 9,609,012, 9,594,545, 9,694 789, 9,594,614, 20 9,607,414, 9,645,975, 9,646,398, 9,667,640, 9,733,974, 9,740,755, 9,740,788, 9,747,316, 9,753,909, 9,753,974, 9,754,459, 9,754,395, 9,767,112, 9,767,122, 9,613,528, 9,61 7,654, 9,617,662, 9,696,596, 9,696,501, 9,696,625, 9,696,674, 9,642,160, 9,642,492, 9,645,598, 2 1 9,916,946, 9,921,790, 9,921,732, 9,922,097, 9,922,065, 9,922,066, 9,922,067, 9,922,082, 9,022,084, 9,922,097, 9,922,099, 9,922,102, 9,922,114, 9,928,262, 9,942,318, 9,977,803, 9,978,127, 9,983,912, 9,983,954, 9,984,128, 9,984,129, 9,990,386, 9,990,423, 9,990,769, 9,992,208, 9,996,571 22 23 24 25 26 27 28 fn

Splunk® Apps 2 The following patents as well as other apply to one or more Sphenk Apps: 10,007,770, 10,049,160, 10,174,665, 10,027 279, 10,152,480, 10,205,649, 10,243,818, 10,257 050, 10.264,106, 10,910,708, 10,954,085, 3 10,545,583, 10,353,965, 10,560,196, 10366,101, 10,374,883, 10,39 79,895, 10,380,799, 10,582,599, 1O S87 408, 10499,922, 10,459,819, 10,460,255, 10,462,002, 10,462,004, 10409 344, 10,474, F235, 10,505,784, 10,515,409, 10,523,521, 10.529,538, 10,596,951, 10,536,356, 10,552,287, 10,564,622, 10,567,557, 10585,851, 10,585,951, 10,592,522, 10,592,525, 10,597,561, 10,592 562, 10,597,563, 10,599,724, 4 10,599, f24, 10,604,298, 10,69 1262, 106 7H 804, 10,084,994, 10,601 525, 10,095, 10,693,743, 10 POO SSR, 10,701,191, 10,719,432, 10,726,009, 10,726,080, 10,747,816, 10,754,698, 10,761,687, 10,761,819, 10,762,049, 10,769,163, 10,775,976, 10,776,140, 10,776,355, 5 TOP Pe, TOP al 1, 10, P95 Fe, POO, 10,860,590, TOA00,618, 10,860,005, 10,060,366, 10685,049, 10,904,080, 10,909,125, 10,909,182, 10,916,063, 10,977,389, 10,922,341, 10,922,625, 10,929,163, 10,929,415, 10,930,565, 10.942 597, 10,951,474, 10,956,462, 10,966,415, 10,970,298, 10,977,260, 10,997,180, 10,997,192, 11,003,475, 11,004,714, 11,070,236, 11,010,495, 11,023,465, 11,073,504, 6 11,029,539, 11096456, 11,074,152, 11,0 75.825, 117,080,945, 11,086,259, 11,086,890, 11,066,097, 11,087 236, 11,093,518, 11,003,564, 17,700,150, 17,700,772, 11,106,440, 17,706,681, 17,106,794, 11,108,659, 11,773,301, 11,113,953, 11,115,505, 17,126,632, 11,127,229, 7 11,132,975, 11,744,185, 11,151,125, 11,057 498, 11,159,597, 11,169,599, 11,163,758, 11,169,900, 11.7 96208, 11,194,552, 11,194,554, 11210278, 11,210,622, 11,276,453, 11218366, 11,222,066, 11,252,100, 11,292,125, 11,238,012, 112358,048, 11,298,112, 112435,963, 11,245,587, 11,250,056, 11,250,971, 11,252,056, 11,256,497, 11,269,229, 11,269,876, 11,269,908, 11,269,099, 11,281,643, 11,281,706, 8 11,288,231, 11,294,941, 11,296,951, 11908,163, 11,914,613, 11,914,737, 11,314,753, 11,921,921, 11,441,131, 11,586,127, 11,592,654, 11,392,655, 11,404,350, 11,405,501, 11,409,756, 11,416,278, 11,416,528, 11422686, 11,429,627, 11416505, 6,683,467, 6,738,587, 9 6,798,629, 6,751 466, 6,795,225, 6 904,569, 6972992, 9,015,016, 043,392, 9,047,181, 9,052,938, 9,122,646, 9,142,049, 9,164, 9,185,007, 9,275,998, 9,323,557, 9477, FT4, 9,419,870, 9,426,045, 9,471,562, 9,495,187, 9,514,189, 9,594,828, 9,596,255, 9,735,974, 9,754,995, 062443) 9,036,502, 9,838,512, 9,916,367, 9,916,479, 9,916,385, 9,921,733, 9,923,767, 9,994,309, 9,995,064, 9,940,496, 10 9,959,015, 9,990,265, 0946,024, 046,025, 046,026

12 Splunk® Technology ‘a 3 The following patents as Well as others apply to Splunk Technology

“a 10,026,204, 10,055,312, 10,061,680, 10.089.143, 10,115,126, 10,204,450, 10,388,067, 10,403,041, 10,409,668, 10,419,525, 10,425,900, 14 10,432,497, 10,460,579, 10,469,546, 10462.493, 10,497,019, 10,545,836, 10,554,788, 10,599,529, 10.628.609, 10,625,771, 10,652,261, 10,657,650, 10,684,954, 10,692,299, 10, 7S5.296, 10,740,970, 10,7 76,818, 10, 7H9279, 10,759,615, 10,810,796, 10,891,648, 10,687,157, © 10,891,792, 10,908,772, 10,971,369, 10,922,495, 10,922,892, 10,937 052, 10,998,654, 10,949,253, 10949420, 10,977 222, 11,070,970, 15 141,007,764, 11,023,547 1, 11,037,192, 17,048,760, 17,07d 152, 141,080,644, 11,702,095, 14,1975,294, 11,727 225, 11,144,556, 11,145,129, 11,182,576, 11,794,647, 11,272,207, 11.216,511, 11,217,023, 11,226,964, 11,297,813, 11,237,922, 11,240,348, 11,263,268, 11,269,859, 16 11,269,871, 11,276,296, 11,276,240, 11.268,379, 11,302,083, 11,905,503, 11,316,749, 11,379,670, 11,266,113, 11,396,158, 11,409,645, a 11,470,409, 11,476,285, 11,430,196, 6,976,036, 6,990,637, 9,009,539, 9,208,000, 9,513,177, 9,024,022, 9,555,006, 9,614,021, 9,660,930, 9,747,152, 9,753,818, 9,007,192, 9,036,358, 9,835,292, 9,058,345, Sea6 7, 9,853,946, 9,916,326, 9,990,769

18 19 Finally, even assuming Cribl knowingly used and copied Splunk software after Splunk 20 terminated the TAP agreement, this does not suggest that Cribl was aware of the five specific 21 asserted patents and that it was infringing them. That Cribl employees could have visited the 22 patent-marking webpage under such circumstances is insufficient to create a plausible 23 inference of pre-suit knowledge (or “willful blindness”). 24 This order recognizes that one circumstance in which willful and indirect patent 25 infringement may be properly alleged despite the absence of a notice letter is when the alleged oa: . 26 infringer “may have had a prior license, but the license ran out.” Sonos, 591 F. Supp. 3d 27 at 644. The license that ran out here, however, derives from the TAP agreement between

=

Splunk and Cribl. It would be unfair to suggest that Cribl’s pre-suit knowledge of the five specific asserted patents could derive from the termination of this agreement. The agreement itself expressly states, inter alia, that Splunk grants Cribl “a non- exclusive, non-transferable, worldwide, non sublicenseable license during the Term to download (and make up to five (5) copies) and use the Splunk Software” (Compl. ¶ 27 (quoting Exh. B § 3.3)). In other words, pursuant to the TAP agreement, Cribl received a software license — an authorization to use Splunk software under Splunk’s intellectual property rights. But the TAP agreement and its license grant never enumerate those intellectual property rights or name the patents-in-suit. The only use of the word “patent” in the agreement is in reference to “remov[ing] or obscur[ing] any copyright, trademark, patent, or other proprietary notices, legends or symbols from the Splunk Software,” which is forbidden. The agreement otherwise only broadly refers to Splunk’s “intellectual property” and “intellectual property rights,” which “nothing in the Agreement transfers or assigns” (Exh. B §§ 4, 5.1). If Cribl had a license that expressly covered the five specific asserted patents, and that license ran out, it would give rise to a plausible inference that Cribl had pre-suit knowledge of the five specific asserted patents and their infringement. But the TAP agreement was no such license. In sum, Splunk’s allegations are insufficient to plead pre-suit knowledge, as required for willful and indirect patent infringement. The motion to dismiss as to Splunk’s willful and indirect patent infringement claims against Cribl is therefore GRANTED. This order does not reach alleged infringers’ alternative arguments regarding Splunk’s allegedly insufficient pleadings of specific intent and lack of substantial non-infringing uses. 2. INELIGIBILITY OF ASSERTED PATENTS. Next, alleged infringers move to dismiss all of Splunk’s patent claims against Cribl based on ineligibility of the five asserted patents under Section 101 of the Patent Act. 35 U.S.C. § 101. When there are no plausible factual disputes after drawing all reasonable inferences in favor of the non-movant, patent eligibility can be determined at the Rule 12 stage. Coop. Ent., Inc. v. Kollective Tech., Inc., 50 F.4th 127, 130 (Fed. Cir. 2022). This order finds that appropriate here. Section 101 addresses the preemption concerns underlying patent law. It provides that whoever “invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.” 35 U.S.C. § 101. The implicit corollary is that laws of nature, natural phenomena, and abstract ideas are not patent eligible. Mayo Collab. Servs. v. Prometheus Labs., Inc., 566 U.S. 66, 70–71 (2012). After all, “monopolization of those tools through the grant of a patent might tend to impede innovation more than it would tend to promote it.” Ibid. “Short and unadorned, [Section] 101 appears deceptively simple on its face, yet its proper application to computer-implemented inventions and in various other fields of technology has long vexed [the Federal Circuit] and other courts.” CLS Bank Int’l v. Alice Corp. Pty., 717 F.3d 1269, 1276 (Fed. Cir. 2013) (en banc) (Judge Alan D. Lourie, concurring), aff’d, 573 U.S. 208 (2014). In Alice Corp. Pty. v. CLS Bank Int’l, 573 U.S. 208 (2014), the Supreme Court set out our two-step inquiry for evaluating patent claims under Section 101. Patent eligibility is assessed by reference to Alice and cases engaging in the Alice two-step analysis. See In re Killian, 45 F.4th 1373, 1383 (Fed. Cir. 2022). At step one, the district court evaluates whether patent claims are directed to an abstract idea. Alice, 573 U.S. at 218. The Federal Circuit has explained that the district court should consider whether the claims “focus on a specific means or method that improves the relevant technology” or are instead “directed to a result or effect that itself is the abstract idea and merely invoke generic processes and machinery.” Apple, Inc. v. Ameranth, Inc., 842 F.3d 1229, 1241 (Fed. Cir. 2016). The district court should also consider whether the claims purport to improve the functioning of a computer or merely require generic computer implementation. Enfish, LLC v. Microsoft Corp., 822 F.3d 1327, 1338–39 (Fed. Cir. 2016); with the benefit of a computer are directed to abstract ideas, as are those that merely gather, analyze, and display information. See Alice, 573 U.S. at 219; Intell. Ventures I LLC v. Cap. One Fin. Corp., 850 F.3d 1332, 1340–41 (Fed. Cir. 2017) (Capital One); Intell. Ventures I LLC v. Symantec Corp., 838 F.3d 1307, 1313–14 (Fed. Cir. 2016) (Symantec); Elec. Power Grp., LLC v. Alstom S.A., 830 F.3d 1350, 1354 (Fed. Cir. 2016). When there are “close calls about how to characterize what the claims are directed to,” “an analysis of whether there are arguably concrete improvements in the recited computer technology could take place under step two.” Enfish, 822 F.3d at 1339. At step two, if the patent claims are directed to an abstract idea, the district court evaluates whether the claimed elements recite an inventive concept that transforms an otherwise abstract idea into a patent-eligible invention. Alice, 573 U.S. at 221. A patent claim must do more than state an abstract idea and say “apply it” or “apply it with a computer.” Id. at 223–24. “[S]imply appending conventional steps, specified at a high level of generality, to laws of nature, natural phenomena, and abstract ideas cannot make those laws, phenomena, and ideas patentable.” Mayo, 566 U.S. at 82. Thus, the district court should consider whether the claims merely recite generic computer processes and machinery or whether the non-generic arrangement of such processes and machinery gives rise to an inventive concept. Bascom Glob. Internet Servs., Inc. v. AT&T Mobility LLC, 827 F.3d 1341, 1349–50 (Fed. Cir. 2016). The step two “[i]nquiry therefore must turn to any requirements for how the desired result is achieved.” Two-Way Media Ltd. v. Comcast Cable Commc’ns, LLC, 874 F.3d 1329, 1339 (Fed. Cir. 2017) (quoting Elec. Power Grp., 830 F.3d at 1355) (emphasis in original). Crucially, the district court may not rely on conclusory statements from the complaint or “technological details set forth in the patent’s specification and not set forth in the claims to find an inventive concept.” Symantec, 838 F.3d at 1322 (citation omitted); see Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 555). Although the pleadings and the specification can illuminate the inventive concept, they cannot supply it. See Am. Axle & Mfg., Inc. v. Neapco Holdings LLC, 967 F.3d 1285, 1293 (Fed. Cir. 2020); ChargePoint, Inc. v. SemaConnect, Inc., The claims mapped in Splunk’s complaint and analyzed in alleged infringers’ motion to dismiss are claim 1 of each asserted patent (see Compl. ¶¶ 120–22, 148–50, 175–77, 204–06, 227–29; Br. 7 n.3, 11 n.5, 15 n.6, 17 n.7, 21 n.10). In its opposition, Splunk argues that these claims are “not representative of all claims in the patents, given meaningful differences in other claims” (Opp. 10) (emphasis in original). Upon review, this order disagrees. In carrying out an Alice analysis, the district court need not address every claim of the patents-in-suit. It may select representative claims where the patentee “does not present any meaningful argument for the distinctive significance of any claim limitations not found in the representative claim” or other claims recited in a patent are “substantially similar and linked to the same abstract idea.” Berkheimer v. HP Inc., 881 F.3d 1360, 1365 (Fed. Cir. 2018); Content Extraction & Transmission LLC v. Wells Fargo Bank, Nat’l Ass’n, 776 F.3d 1343, 1348 (Fed. Cir. 2014) (citation omitted). Splunk mapped the first claim of each asserted patent — and only the first claim of each asserted patent — in the complaint. Its cursory comments on a few independent and dependent claims in the opposition do not present meaningful arguments for meaningful differences. Accordingly, this order finds claim 1 of each asserted patent representative. Even so, it will briefly explain why those scattered other claims mentioned in Splunk’s opposition are substantially similar and linked to the same abstract idea as the representative claims in its analysis of those representative claims. Although Splunk argues it would be premature to address patent eligibility at this juncture, dropping a footnote that says “analysis of the total number of infringed claims in this case is ongoing” and that estimates “disclosures will identify over 50 [infringed] claims” cannot postpone this day of reckoning (Opp. 10 n.2). Indeed, this action is not analogous to Krush Technologies LLC v. Zoom Video Communications, Inc., 2019 WL 8107871 (N.D. Cal. July 23, 2019), where the undersigned declined to resolve Section 101 issues at the Rule 12 stage. Here, the complaint specifies claims that are infringed, and the question of eligibility is not intertwined with questions of fact, as will be discussed in detail below. Id. at *2. 1 Having determined that claim | of each asserted patent is representative, this order takes 2 up the representative claims. 3 B. THE ’206 PATENT. 4 Let’s begin with the ’206 patent, entitled “Selecting Parsing Rules Based on Data 5 Analysis.” The representative claim discloses a method for “selecting a portion of raw data 6 from at least one data source”; “analyzing [it] to find a match . . . corresponding to a parsing 7 rule in a plurality of stored parsing rules”; “parsing [it] into a set of searchable, time-stamped 8 events .. . using the parsing rule”; “causing display of a preview . . . in a graphical user 9 interface”; and “in response to user input received via the graphical user interface,” 10 “processing” at least some data not in the selected portion “using the parsing rule . . . to create 11 searchable, time-stamped events” (°206 patent, col. 20:46—53, 57-59, 60-63; see generally id. 12 at col. 20:45-67). The final limitation is that the method “is performed by one or more 13 computing devices” (id. at col. 20:66-67). 14 Translating the jargon, “raw data” refers to data before it has been processed (id. at col. 15 3:24-26). Although “parsing rule” is not expressly defined, the specification and complaint 16 provide numerous demonstrative examples (see, e.g., id. at col. 3:14—20; Compl. §] 187). The 17 complaint, for instance, points to a parsing rule in Cribl’s documentation that separates raw 18 data into events by looking for a new line symbol (“1”) and a timestamp (e.g., “2021/10/09 19 10:19:15”): 20 21 pc ES. 32,3

Parsed raw data with timestamp, Complaint, 1187 25 26 (Reply Br. 2 (citing Compl. { 187)). 27 Per Alice step one, alleged infringers argue that the representative claim is directed to a 28 patent-ineligible abstract idea of “selecting a subset of test data from a larger data set,”

“applying a rule to look for a pattern match within the test data,” and “if the rule works, applying that rule to the larger data set” (Br. 6). They emphasize that this mental process has been performed, albeit less efficiently, by humans for many years, and that any alleged improvement results from “user input” (determining the stored parsing rule works before applying it to the larger data set) (Br. 7–8). Splunk counters that this claim and others are not directed to an abstract idea because they are “‘necessarily rooted in technology in order to overcome a problem specifically arising in the realm of’ computer search engine indexes” (Opp. 10–11 (quoting SRI Int’l, Inc. v. Cisco Sys., Inc., 930 F.3d 1295, 1303 (Fed. Cir. 2019)). According to Splunk, mental processes like pattern-matching “bear no resemblance to software that improves the construction of search engine indexes from raw machine data” (Opp. 11). Recall, however, that unclaimed features are irrelevant to the Alice analysis. Am. Axle & Mfg., Inc., 967 F.3d at 1293; ChargePoint, Inc., 920 F.3d at 769. The specification explains that if “improper index data may be added to an index store it may pollute the index reducing the quality of search results that may be produced” (’206 patent, col. 1:38–40). But the claim language itself does not describe technologically rooted improvement. Although Splunk states in its opposition that “the claims describe software techniques that better define events before indexing occurs, in conjunction with improved rule selection,” the only recited improvement is supplied by the user (Opp. 11). Note the representative claim does not specify how to select parsing rules based on data analysis. The rules are already “stored,” and the user decides whether parsing a broader portion of data using a stored rule is appropriate after parsing a smaller portion of data using that stored rule. The claim does not “focus on a specific means or method that improves the relevant technology” but is rather “directed to a result or effect that itself is the abstract idea and merely invoke[s] generic processes and machinery.” Apple, 842 F.3d at 1241 (citation omitted). It is the user who “better define[s] events before indexing occurs” and “improve[s] rule selection,” not any software technique disclosed. What’s more, a “software technique” is not even disclosed here. Unlike in Enfish, the merely requires generic computer implementation “wherein the method is performed by one or more computing devices.” This claim “at most recite[s] abstract data manipulation” and is “recited at such a level of result-oriented generality that [it] amount[s] to a mere implementation of an abstract idea.” Hawk Tech. Sys., LLC v. Castle Retail, LLC, 60 F.4th 1349, 1358 (Fed. Cir. 2023) (citation omitted). Here (and elsewhere), Splunk analogizes to SRI, which rejected likening a computer method to one which could be performed in the human mind, because the “human mind is not equipped to detect suspicious activity by using network monitors and analyzing network packets as recited by the claims.” SRI, 930 F.3d at 1304. According to Splunk, a human mind is likewise not equipped to “analyze raw machine data to select a parsing rule to segment that data into events” (Opp. 11). But that is what the human mind is asked to do here, as Splunk itself acknowledges (see, e.g., Opp. 12 (explaining “the claims describe creating events from raw data based on a parsing rule, and previewing what those events look like via a graphical interface, to allow for modifying events based on the user’s input at that interface”) (emphasis added)). True, a human mind is not equipped to “graphically preview how those events would be formed” using a graphical user interface and “build searchable events for a time-searchable search engine index,” but these are the generic processes and machinery used in generic computer implementation. Apple, 842 F.3d at 1241; Enfish, 822 F.3d at 1337–39. At bottom, unlike the representative claim in SRI, the representative claim here does not improve the functioning of a computer by reciting a specific technique. Nor do any of the ’206 patent claims, for that matter. As observed by Splunk, independent claims 19, 26, and 33 respond to user input indicating a “preference not to use the” parsing rule that generated a preview, but this does not render the focus of these claims any less abstract (Opp. 6) (emphasis in original). Each still involves parsing a broader selection of data pursuant to another parsing rule based on user input after previewing the application of that parsing rule on a smaller selection of data (’206 patent, cols. 22:65–67; 23:1–28, 59–76; 24:1–27, 58–67; 25:1–22). This order finds that the representative claim is directed to the abstract idea of previewing claim’s final limitation suggests, the claim is not “directed to a specific implementation of a solution to a problem in the software arts.” Enfish, 822 F.3d at 1339. Humans have been previewing data analysis rules on test samples for time immemorial. The associated organizing, displaying, and manipulating of data are all directed to this abstract idea. See Capital One, 850 F.3d at 1340–41. Turning to Alice step two, alleged infringers argue that the representative claim fails to recite a saving inventive concept because it merely recites abstract information and mental steps processing this abstract information, which are purely functional (Br. 9). Thus, although Splunk “may tout the inherent benefits of better data filtering or improved mental processes,” the representative claim “doesn’t even go that far” (Br. 10). Splunk responds that its allegations create a plausible factual issue regarding the inventiveness of the claims at Alice step two sufficient to survive a motion to dismiss. It also points out that its claims include “more implementation detail” than claims in other actions in which the Federal Circuit has found a factual dispute (Opp. 13). This order finds the representative claim fails to recite a saving inventive concept. Splunk is correct that eligibility is ultimately a question of law that may be based on underlying questions of fact. Berkheimer, 881 F.3d at 1365. And the Federal Circuit has held that whether a claimed invention is “well-understood, routine, and conventional” under Alice step two is “a question of fact.” Id. at 1368. But “not every [Section] 101 determination contains genuine disputes over the underlying facts material to the [Section] 101 inquiry.” Ibid. And conclusory allegations of factual disputes do not themselves make factual disputes. Here, as explained above, “the purported improvements have not been captured in the claim language.” Voip-Pal.com, Inc. v. Apple Inc., 375 F. Supp. 3d 1110, 1145 (N.D. Cal. 2019) (Judge Lucy H. Koh), aff’d sub nom. Voip-Pal.com, Inc. v. Twitter, Inc., 798 F. App’x 644 (Fed. Cir. 2020). “Nothing in the claims, understood in light of the specification, requires anything other than off-the-shelf, conventional computer, network, and display technology for gathering, sending, and presenting the desired information.” Elec. Power Grp., 830 F.3d of whether the alleged improvements are ‘well-understood, routine, and conventional.’” Voip- Pal.com, Inc. v. Apple Inc., 411 F. Supp. 3d 926, 974 (N.D. Cal. 2019) (Judge Lucy H. Koh), aff’d, 828 F. App’x 717 (Fed. Cir. 2020). Moreover, the fact that there is more implementation detail here has no bearing on this analysis. “Even a specification full of technical details about a physical invention may nonetheless conclude with claims that claim nothing more than the broad law or abstract idea underlying the claims, thus preempting all use of that law or idea.” ChargePoint, Inc., 920 F.3d at 769. The elements of the representative claim of the ’206 patent thereby fail to add something more and transform the claimed abstract idea into a patent-eligible invention. The analysis of ’206 patent provides a helpful framework for assessing the other patents- in-suit. The parties make substantially similar arguments about all of the representative claims: Splunk asserts that they are rooted in technology in order to overcome technical problems identified in the associated specifications, and alleged infringers highlight a disconnect between the claim language and the specification language. Although this order will speak to the specifics of the subsequent representative claims, the reader should bear in mind that these patents are ineligible for essentially the same reasons. C. THE ’438 AND ’443 PATENTS. Next, this order turns to the ’438 and ’443 patents, which are entitled “Configuring the Protocol-Based Generation of Event Streams” and “Transformation of Network Data at Remote Capture Agents,” respectively. The ’438 and ’443 patents are taken up together because Splunk takes them up together (Opp. 6–7; 13–17). The representative claims of the ’438 and ’443 patents disclose methods implemented in a distributed arrangement involving at least one configuration server and one remote capture agent (“RCA”). Reductively, a configuration server (computer) sends configuration data (instructions) to an RCA (computer) to generate time-stamped events from monitored network packets. Stripped of excess verbiage, the ’438 patent discloses a method that enables an RCA to “generate [an] event [data] stream based on the network traffic monitored . . . according to 44; see generally id. at col. 24:26–46). The configuration server “receiv[es] input” that “indicat[es] a protocol to be associated with the event stream” and “an event attribute associated with the protocol,” and it sends configuration data to the RCA based on this input (id. at col. 24:29, 32–33, 36–37, 40–42). Note RCAs “can be physical hardware servers or virtual machines running in the cloud” and “capture network data originating from numerous distributed network servers” (id. at cols. 4:65–67; 5:1–2). The ’443 patent, on the other hand, discloses a method for an RCA to “generat[e], based on [] configuration information, time- stamped event data from at least one network packet of [a] plurality of network packets,” “transforming” the time-stamped event data by “performing an operation” on it (’443 patent, col. 26:38–40, 45–49; see generally id. at col. 26:27–49). Per Alice step one, alleged infringers argue that Splunk has engaged in “broad, functional claiming,” “the hallmark of abstractness” (Reply Br. 4 (citing Voip-Pal.com, 375 F. Supp. 3d at 1133)). With regard to the representative claim of the ’438 patent, they emphasize that the specification acknowledges the prior art included network elements that could monitor, capture, and transform data, thereby indicating the purported improvement is to configure the network elements in a centralized manner over a distributed network (Br. 15). Alleged infringers aver that courts routinely find claims for distributed computing, including coordination to break up tasks across multiple computers, directed to abstract ideas and ineligible (Br. 15–16). As for the representative claim of the ’443 patent, alleged infringers point out that it merely recites (functional) steps of “monitoring,” “segmenting” and “transforming” network data, without reciting steps for processing network traffic any differently than conventional network capture devices beyond, again, incorporating distributed computing (Br. 11–12). Meanwhile, according to Splunk, both patents “claim specific techniques for using configurable ‘remote capture agents’” and address problems arising from “challenges with conventional network capture and analysis technologies” that were “‘fixed,’ ‘built . . . to serve a specific purpose,’ and unamenable to reconfiguration (among other problems)” (Opp. 14 the claims “do not automate a conventional idea, but instead claim techniques to solve problems with the conventional, inflexible approach to capturing and analyzing network data” (Opp. 14). According to Splunk, alleged infringers oversimplify the claims and “ignore specific requirements of the independent claims, including regarding the data that must be provided to the server to accomplish configuration of the related remote capture agent” (Opp. 15 (citing ’438 patent, col. 24:32–39)). This order finds the representative claims merely invoke generic processes and machinery, and that they are directed to results that are, in essence, abstract ideas. See Apple, 842 F.3d at 1241. “Here, the claims themselves do not disclose performing any ‘special data conversion’ or otherwise describe how the alleged goal” — “fixing the conventional, inflexible approach to capturing and analyzing network data” (Opp. 14) — “is achieved.” Hawk Tech. Sys., 60 F.4th at 1357. As observed by alleged infringers, for both patents, “neither the claims nor the specifications provide guidance on how the RCA monitors the network packets, how it obtains the configuration information remotely, how the server generates configuration information that the RCA can use remotely to generate timestamped event data from the network packets, and how the RCA performs operations on the event data to transform it” (Reply Br. 4) (emphasis in original). In other words, neither the claim language nor the specification language provides guidance on how the claims achieve their functional results. The Federal Circuit has repeatedly found claims that did “not sufficiently describe how to achieve these results in a non-abstract way” to be directed to abstract ideas. Two-Way Media, 874 F.3d at 1337 (citing Affinity Labs of Tex., LLC v. DIRECTV, LLC, 838 F.3d 1253, 1258–59 (Fed. Cir. 2016); Elec. Power Grp., 830 F.3d at 1351)). The representative claim of the ’438 patent is directed to the abstract idea of generating (event) data by applying (configuration) data it receives to (network) data it monitors. The representative claim of the ’443 patent is directed to the abstract idea of monitoring (network) data and applying (configuration) data received to generate and transform (event) data. Note claim 7 of the ’443 patent is “substantially similar and linked to the same abstract idea” as “application” that “access[es] the transformed event data” does not render the abstract idea any less abstract; (network) data are still monitored, (configuration) data are still received, and (event) data are still generated and transformed.1 Moreover, that the methods call for an RCA does not render the focus of the representative claims any less abstract (see ’438 patent, col. 24:27, 41–45; ’443 patent, col. 26:29). As noted by alleged infringers, Splunk’s patents acknowledge “conventional” capture devices already processed network packet data into separate events (Reply Br. 6 (citing, e.g., ‘438 patent, cols. 1:41–67, 2:1–19)). Whereas the representative claims in SRI were directed to more than an abstract idea and “over[ode] [a] routine and conventional sequence of events,” the representative claims here “merely require[] a ‘computer network operating in its normal, expected manner.’” SRI, 930 F.3d 1295, 1304 (Fed. Cir. 2019) (quoting DDR Holdings, LLC v. Hotels.com, L.P., 773 F.3d 1245, 1258 (Fed. Cir. 2014)). Unlike the representative claims in SRI and DDR, the representative claims here do not offer specific technical solutions to specific technical problems identified in the specifications. Turning to Alice step two, Splunk argues that the specifications indicate the components are not generic and, even if they were, “useful improvements to computer networks are patentable regardless of whether the network is comprised of standard computing equipment” (Opp. 16 (quoting Kollective, 50 F.4th at 135)). Moreover, according to Splunk, it is “entitled to the plausible inference of an inventive concept from the allegations in its Complaint regarding the existence of technological problems in the prior art and the solutions the claims offer to address those problems” (Opp. 16–17). This order agrees with alleged infringers, however, that unlike the claims disclosing particular enhancements to computer technology the Federal Circuit has found eligible at step two, the representative claims here merely apply result-oriented, abstract ideas without specifying any non-conventional way to accomplish or practice them (Reply Br. 8). Again, the eligibility of the representative claims does not turn on

1 Splunk only discusses other independent claims in the ’438 and ’443 patents in conjunction with the factual issue of whether the alleged improvements are well-understood, routine, and conventional because no alleged improvement is captured in the claim language. Again, “[n]othing in the claims, understood in light of the specification, requires anything other than off-the-shelf, conventional computer, network, and display technology for gathering, sending, and presenting the desired information.” Elec. Power Grp., 830 F.3d at 1355. As such, the elements of the representative claims of the ’438 and ’443 patents fail to add something more and transform the claimed abstract ideas into patent-eligible inventions. D. THE ’312 PATENT. This order now considers the ’312 patent, entitled “Time Stamp Creation for Event Data.” The representative claim discloses a method for “creating a set of searchable events by segmenting raw time series machine data from at least one data source” (’312 patent, col. 17:11–13; see generally id. at col. 17:9–48). According to the specification, “[s]egmentation rules describe how to divide event data into segments” (id. at col. 10:59–60). In order to create a set of searchable events, the claimed method calls for “detecting whether time information is present in the raw time series machine data” (id. at col. 17:23–24). It provides two paths for creating events based on whether time information is present or not: • If “time information is present in the event,” it is “extract[ed]” and used to “determin[e] a time zone”; the time zone is used “generat[e] an offset,” thereby “normalizing the extracted time information”; and a “time- stamp based on the offset” is “associated with the event.”

• If “time information is not present in the event,” a time stamp is “calculated” by “using one or more stored time stamps . . . from one or more earlier processed events selected on a periodic basis in order to facilitate time stamp creation”; and a “time stamp is “associate[ed] with the event.” (id. at col. 17:26–46). The associating of time stamps “enabl[es] the events to be searched” (id. at col. 17:35, 45). The final limitation is that “the method is performed by one or more computing devices” (id. at col. 17:47–48). Per Alice step one, alleged infringers argue that the representative claim cites a patent- ineligible mental process. According to alleged infringers, this mental process is analogous to that of an assistant who receives a collection of pages reflecting meeting minutes, and separates (“segments”) those pages into individual reports, one report for each meeting. The assistant then reorganizes the reports chronologically, using the time and date written at the top of each report. The assistant can take into account the geographic location of a meeting, adjusting the meeting’s time and date based on its time zone. If a report lacks time or date information, the assistant can assign a time and date “based on its context,” using other information in the report, such as the meeting attendees, meeting location, and topics discussed. (Br. 18). That this mental process is untethered from a technical environment is purportedly demonstrated by the failure to incorporate any computer or computing components until the final limitation (ibid.). Further, according to alleged infringers, the functional language is unbounded, with no technical details explaining how the steps are to be accomplished. And alleged infringers emphasize that any benefits arising from the claimed invention flow not from improved technology but from performing an abstract idea in conjunction with well- known computer technology and functional components (Br. 19). Meanwhile, Splunk once more emphasizes that the patent claims are necessarily rooted in technology rather than a mental process. According to Splunk, the attempt to analogize to an assistant is inapt because humans cannot “segment raw time series machine data received from at least one data source in an information technology environment into searchable events,” “perform the claimed timestamping techniques on each event,” and “thereby enable time-based searches across an index of events created from the raw data” (Opp. 18 (internal quotations and citations omitted)). Moreover, the claims “recite sufficient implementation detail to perform the claimed steps in a non-abstract way,” with the specification “provid[ing] even more implementation detail” (Opp. 19). Like the preceding representative claims, the representative claim of the ’312 patent does not disclose a technologically rooted improvement but rather another generic computer implementation “wherein the method is performed by one or more computing devices.” Note the representative claim does not disclose how to “calculat[e] a time stamp for [an] event using one or more stored time stamps,” which are “selected on a periodic basis in order to facilitate time stamp creation,” when time information is unavailable (’312 patent, col. 17: 39–43). It “merely carr[ies] out a longstanding commercial practice with the benefit of a computer” and “manipulates data but fails to do so in a non-abstract way.” Alice, 573 U.S. at 219; Two-Way Media, 874 F.3d at 1338. This order finds the assistant analogy is appropriate. The representative claim is directed to the abstract idea of creating time-searchable output by determining whether time information is available in a given input, and using time information from earlier inputs as a proxy if time information is unavailable. Splunk underscores that this input could “include unstructured data” per claims 6, 10, and 14 (Opp. 18). But adjusting the given input to encompass different data does not render the claimed idea any less abstract. Cf. BSG Tech LLC v. BuySeasons, Inc., 899 F.3d 1281, 1288 (Fed. Cir. 2018) (“[A]n improvement to the information stored by a database is not equivalent to an improvement in the database’s functionality.”). Turning to Alice step two, again, the representative claim and the alleged improvement discussed in the complaint and specification are misaligned. Voip-Pal.com, 375 F. Supp. 3d at 1145; Elec. Power Grp., 830 F.3d at 1355. The representative claim simply does not capture how to “improv[e] machine data analysis” given “problems with the way conventional computer search engines handled analysis and indexing of raw time series machine data” (Opp. 17). Not only are the claim language and specification language misaligned here, but they also appear to be mismatched. Although the representative claim (and each independent claim) discloses using a stored time stamp “from one or more earlier processed events” if time information is not available, the specification discusses an implementation in which “further earlier and/or later events can be used for interpolation” (compare ’312 patent, col. 17:41–41, and id. at cols. 18:37–38, 20:1–2, with id. at col. 9:37–40). Meanwhile, in isolation, the use of generic computer components in conventional ways do not provide an inventive concept. The elements of the representative claim of the ’312 patent thereby fail to transform the claimed A. THE ’467 PATENT. Finally, this order turns to the ’467 patent, entitled “Dynamically Instantiating Dual- Queue Systems.” The representative claim discloses a method for implementing a “multi- tenant dual-queue system” that “receiv[es] . . . live data” and “rout[es] the live data to [a] dual- queue node” if, “based on determining that [the node] . . . is uninstantiated,” the node is “dynamically instantiat[ed]” (’467 patent, col. 24:33, 35–37, 43; see generally id. at col. 24:31–43). “[D]ynamically instantiating” initializes “a live data queue and a stale data queue” (id. at col. 24:36, 38–39). The “initialized live data queue is enabled to receive the live data for processing,” whereas “the initialized stale data queue is enabled to store a persistent backup of the live data” (id. at col. 24:39–43). According to the specification, whereas “a single tenant dual-queue system may include one or more servers . . . that have resources continuously or permanently dedicated to incoming or outgoing data of a single customer,” “multi-tenant dual- queue systems may include one or more servers . . . that have resources temporarily, ephemerally, or transiently allocated to incoming or outgoing data of each of a plurality of customers on an as-needed or in an on-demand basis” (id. at cols. 2:67, 3:1–8). Servers “may be general or special-purpose computers” (id. at col. 4:27–28). Per Alice step one, alleged infringers assert that the representative claim is directed to the long-prevalent practice of handling overflow traffic on demand, and that “it recites mere functions and results unlimited by particular structures or acts for how to perform or achieve them” (Br. 22). According to alleged infringers, the representative claim remarkably provides no technical details as to how the otherwise conventional dual-queue node is “dynamically” instantiated (ibid.; Reply Br. 12). “Setting up storage of incoming data in a secondary location for later transmission simply implements generic computer functionality of receiving and storing data,” which then “fails as an inventive concept” at Alice step two (Br. 22). Splunk responds that its claims are directed to a specific improvement in the software arts, not an abstract idea (Opp. 21). Although Splunk’s complaint expressly describes the improvement as addressing situations where “streams of live data [] can be generated faster than they can be 8:47–59), Splunk’s opposition describes it as “instead directed to specific techniques for instantiating dual-queue ‘nodes’ in a ‘multi-tenant’ environment that improves on conventional software practice” (Opp. 21) (emphasis in original). Even though this language is rife with what are arguably this order’s most technical terms, beneath the surface is arguably this order’s most abstract idea. The representative claim here is directed to handling overflow data on demand. No “particular technique for dynamically instantiating dual-queue nodes” is disclosed (Opp. 22). Again, the claim is result- oriented: there are no details as to how the dual-queue node is “dynamically” instantiated, how the live data queue is “enabled” to receive “live data for processing,” or how the stale data queue is “enabled” to store a “persistent backup of the live data” (’467 patent, col. 24:36–37, 40, 42); Apple, 842 F.3d at 1241. Moreover, the dependent claims referenced in Splunk’s opposition do not have any bearing on this determination. Some involve dual-queue nodes “assigned to [a] customer” (see, e.g., ’467 patent, col. 24:49). Others involve dual-queue nodes assigned to “an Internet of Things device” (see, e.g., id. at col. 24:63). But in any event, the claims are still directed to the abstract idea of handling overflow data on demand (now, for that customer or that device). “[L]imiting the claims to a particular technological environment . . . renders them no less abstract.” People.ai, Inc. v. SetSail Techs., Inc., 575 F. Supp. 3d 1193, 1200 (N.D. Cal. 2021) (citing Capital One, 850 F.3d at 1340). Yet again, the inventive concept remains elusive. This order agrees with alleged infringers that Splunk appears to be doing some strategic recasting of purported improvement in its opposition (see Reply Br. 11–12). In any event, the representative claim does not disclose an inventive solution to the problem identified in the specification and Splunk’s complaint — that of avoiding lost data when incoming live data arrives too quickly — beyond standard caching and storing (Reply Br. 13). Nothing in it addresses increasing the amount of live data that is received or other analogous improvements that could supply an inventive concept. The representative claim only recites generic computer processes and machinery, and a generic arrangement. Bascom, 827 F.3d 1341, 1349–50 (Fed. Cir. 2016). In sum, all of the representative claims of the patents-in-suit are directed to abstract ideas and lack saving inventive concepts. As such, all of the patents-in-suit run afoul of Section 101 and do not qualify as patent eligible. The motion to dismiss as to Splunk’s patent infringement claims against Cribl is GRANTED. 3. INDIRECT COPYRIGHT INFRINGEMENT. Turning to copyright law, alleged infringers argue that Splunk’s indirect copyright infringement claims against them should be dismissed because Splunk does not adequately allege that Cribl and CEO Sharp had the knowledge and intent required for contributory infringement.2 According to accused infringers, Splunk makes no allegations regarding Cribl’s knowledge and baldly alleges that CEO Sharp acted “with knowledge” and “intentionally” (Br. 24 (citing Compl. ¶¶ 267, 271)). Splunk counters that it expressly alleges both accused infringers materially contributed to or induced copyright infringement, such as when they facilitated the copying, distribution, and creation of derivatives of Splunk’s code with each new version of Cribl’s software (Opp. 24 (citing Compl. ¶¶ 267 –70)). According to Splunk, it has also alleged the requisite intent: [F]or example: “Mr. Sharp copied Splunk’s copyrighted source code for S2s [and] created a derivative of that code (go-S2S)” ([Compl.] ¶ 266), with “the intention of using it for his own personal financial gain at a different company,” i.e., Cribl (id. ¶ 36); [Mr.] Sharp provided this code to Cribl for its use within Stream, and, to this day, has encouraged and induced Cribl’s use of this code”; “go-S2S, and/or other source code copied or derived from Splunk’s Splunk Enterprise source code, is currently used within Stream and has been used within Stream since its release” (id. ¶ 40); and [alleged infringers] “sought to capitalize on their access to the S2S version 3 protocol” (id. ¶ 38). This supports a plausible inference that [alleged infringers] had knowledge of, and intended, each other’s infringement. (Opp. 24–25). Here, this order agrees with Splunk that it has plausibly pleaded contributory infringement. 2 Specifically, alleged infringers assert “Splunk does not adequately allege that Cribl or CEO Sharp had the knowledge or intent required to plead contributory or induced copyright infringement,” but as explained below, in copyright law (unlike in patent law), induced infringement is housed within contributory infringement. Note that although alleged infringers Contributory copyright infringement is a “a form of secondary liability with roots in the tort-law concepts of enterprise liability and imputed intent . . . . [O]ne contributorily infringes when he (1) has knowledge of another’s infringement and (2) either (a) materially contributes to or (b) induces that infringement.” Perfect 10, Inc. v. Giganews, Inc., 847 F.3d 657, 670 (9th Cir. 2017) (quoting Perfect 10, Inc. v. Visa Int’l Serv., Ass’n, 494 F.3d 788, 794–95 (9th Cir. 2007)). Because Splunk brings contributory infringement claims against both CEO Sharp and Cribl, this order must consider whether, on the face of the complaint, (1) CEO Sharp had knowledge of others’ copyright infringement and materially contributed to or induced it; and (2) Cribl had knowledge of others’ copyright infringement and materially contributed to or induced it. Accepting all factual allegations in the complaint as true and construing the pleadings in the light most favorable to Splunk, it seems CEO Sharp had knowledge of others’ infringement because, inter alia, he “derived go-S2S from Splunk’s copyrighted source code,” “provided this code to Cribl . . . with knowledge that go-S2S was an unlicensed derivative of Splunk’s copyrighted S2S version 3 code,” and “each new version of Cribl’s Stream software includes a new copy of this unlicensed derivative of Splunk’s copyrighted S2S version 3 code” (Compl. ¶¶ 36, 40–41). Similarly, accepting all factual allegations in the complaint as true and construing the pleadings in the light most favorable to Splunk, it seems CEO Sharp materially contributed to or induced (1) Cribl’s infringement because “Sharp provided this code to Cribl for its use within Stream, and, to this day, has encouraged and induced Cribl’s use of this code”; and (2) Cribl customers’ infringement because “go-S2S, and/or other source code copied or derived from Splunk’s Splunk Enterprise source code, is currently used within Stream and has been used within Stream since its release” (Compl. ¶ 40). A corporate officer is personally liable for all torts he authorizes or directs or in which he participates (notwithstanding that he acted as an agent of the corporation and not on his own behalf). Coastal Abstract Serv., Inc. v. First Am. Title Ins. Co., 173 F.3d 725, 734 (9th Cir. 1999). Turning to Cribl’s alleged contributory infringement, accepting all factual allegations in complaint clearly provides for the possibility that CEO Sharp’s knowledge could be attributed to Cribl as well. According to Splunk’s complaint, “Mr. Sharp and Cribl sought to capitalize on their access to the S2S version 3 protocol” (Compl. ¶ 38). Similarly, the complaint contains language that could support Cribl’s material contribution to or inducement of others’ copyright infringement (see, e.g., Compl. ¶¶ 47, 40 (alleging “Cribl has used its illicitly obtained support for the S2S version 3 protocol as a means to convince Splunk’s customers to buy software and services from Cribl” and “go-S2S, and/or other source code copied or derived from Splunk’s Splunk Enterprise source code, is currently used within Stream and has been used within Stream since its release”)). As such, CEO Sharp may have acted as an agent of Cribl at the time he knew of customers’ infringement and materially contributed to or induced it. Of course, it may be that CEO Sharp’s co-founders had no idea that Cribl’s source code was derived from go-S2S or that go-S2S was derived from Splunk’s copyrighted code. And it may be that go-S2S is not even a derivative of Splunk’s copyrighted code. But Splunk’s allegations are sufficient to survive a motion to dismiss. Because Splunk has plausibly pleaded contributory copyright infringement against CEO Sharp and Cribl, the motion to dismiss as to Splunk’s contributory copyright claims is DENIED. 4. VIOLATION OF DIGITAL MILLENNIUM COPYRIGHT ACT SECTION 1202. Lastly, this order considers whether Splunk’s claim for violation of Digital Millennium Copyright Act (“DMCA”) Section 1202 against CEO Sharp should be dismissed. According to Cribl, this dismissal is warranted for two reasons: (1) Splunk has failed to plead copyright management information (“CMI”) with the specificity that courts in this district have required, and (2) Splunk has failed to plead the required scienter for a violation of Section 1202 (Br. 24– 25). Splunk counters that it has pleaded CMI and scienter with sufficient specificity. Again, this order agrees with Splunk. Section 1202(a) prohibits knowingly and intentionally inducing, enabling, facilitating or concealing copyright infringement by (1) providing false CMI and (2) distributing or importing for distribution false CMI. 17 U.S.C. § 1202(a)(1)–(2). Section 1202(b) prohibits distribution CMI that has been removed or altered, and (3) knowingly distributing, importing for distribution, or publicly performing works or copies of works whose CMI has been removed or altered. Id. § 1202(b)(1)–(3). Splunk alleges that CEO Sharp violated both provisions (Compl. ¶¶ 291–92). The relevant claim language provides, in pertinent part: As described above, Clint Sharp created the go-S2S source code by copying copyrighted Splunk source code, which contained Splunk copyright headers indicating authorship and ownership information reflecting Splunk’s copyright in this code. Mr. Sharp’s derivative go-S2S code, however, did not include headers indicating Splunk’s authorship and ownership of the copyright in the go-S2S code; Mr. Sharp therefore provided false CMI and intentionally removed or altered CMI in creating the go-S2S code, without the authority of Splunk.

Mr. Sharp distributed code containing false, removed, and altered CMI for the entire duration of time that he maintained the go-S2S source code repository online, and at least until December 2021. Any time Mr. Sharp’s go-S2S source code repository was accessed, Mr. Sharp distributed code containing this false, removed, and altered CMI. Mr. Sharp also provided and distributed code containing false CMI by uploading an open-source MIT license to the go-S2S github repository, falsely identifying Mr. Sharp as the author and/or owner of the copyright in the go-S2S code, and falsely providing open-source terms for use of the go-S2S code, despite its derivation from Splunk’s source code.

Mr. Sharp distributed code containing this false CMI from December 2018 at least until December 2021. Any time Mr. Sharp’s go-S2S source code repository was accessed, Mr. Sharp distributed code containing this false, removed, and altered CMI. (Compl. ¶¶ 294–97). These facts are also set out in the complaint’s “General Allegations” (Compl. ¶¶ 37, 42–44). Starting with specificity of pleading CMI, this order agrees with Splunk that it adequately described the CMI at issue and that alleged infringers cite cases that do not suggest more is required (Opp. 25). Whereas in Free Speech Systems, LLC v. Menzel, 390 F. Supp. 3d 1162, 1175 (N.D. Cal. 2019) (Judge William H. Orrick), the copyright owner failed to provide “any facts to identify which photographs had CMI removed or to describe what the removed or altered CMI was,” there is no question here that, as alleged, the CMI was removed from the go-S2S code and the CMI was code that “indicat[ed] authorship and ownership information reflecting Splunk’s copyright” (Compl. ¶ 294). Whereas in SellPoolSuppliesOnline.com, LLC v. Ugly Pools Arizona, Inc., 804 F. App’x 668, 670–71 (9th Cir. 2020), the CMI “allegedly removed by [alleged infringers] did not identify [the copyright owner] as the owner or author of any content on the website,” Splunk has expressly alleged that the removed copyright headers indicated authorship and ownership (Compl. ¶ 294). And whereas in Logan v. Meta Platforms, Inc., 2022 WL 14813836, at *8 (N.D. Cal. Oct. 25, 2022) (Judge Charles R. Breyer), the CMI was “separated from the rest of the content on the webpage,” here Splunk specifically stated that the headers were removed from the go-S2S code itself (Compl. ¶ 292). The Court may later determine that the CMI was not, in fact, CMI (as defined in Section 1203); or that the copyright headers did not, in fact, identify Splunk as an owner or author; or that they were not, in fact, removed from the go-S2S code; or that the go-S2S code was not, in fact, a derivative of Splunk’s copyrighted source code. For now, however, the CMI is sufficiently pleaded to survive a motion to dismiss. As for the argument that Splunk has failed to plead the required scienter for a violation of Section 1202, that is foreclosed by the language in Splunk’s complaint. According to the complaint, “[i]n or around December 2018, Mr. Sharp added an open-source MIT license to the go-S2S source code on his personal [G]it[H]ub webpage, falsely identifying himself as the author and/or owner of the copyright in the go-S2S code, and falsely providing open-source terms for use of the go-S2S code, despite its derivation from Splunk’s proprietary source code” (Compl. ¶ 42). CEO Sharp allegedly “added this false license to the go-S2S code to obscure his own unlawful copying of Splunk’s copyrighted source code” (Compl. ¶ 43). Alone, this is sufficient to plead a violation of Section 1202(a) (involving false CMI). True, Splunk does not directly allege that CEO Sharp’s removal of the copyright headers indicating authorship and ownership information was “knowing.” But the complaint states that “Mr. Sharp derived go-S2S from Splunk’s copyrighted source code with the intention of using it for his own personal financial gain at a different company,” that “[t]he Splunk S2S version 3 code that Mr. Sharp copied contained Splunk copyright headers indicating authorship and 1 “Mr. Sharp removed this information from the derived files that he posted on his personal 2 [G]it[H]ub page” (Compl. J] 36-37). Construing this in the light most favorable to Splunk, 3 that CEO Sharp removed these headers from proprietary source code and posted that source 4 code to a personal, publicly accessible webpage supports a plausible inference that he did so 5 knowingly — especially when he later added an open-source license that “falsely identif[ied] 6 [CEO Sharp] as the author and/or owner of the copyright in the go-S2S code” (Compl. { 42). 7 As such, the language in the complaint is sufficient to plead a violation of Section 1202(b) 8 Gnvolving removed or altered CMI) as well. 9 Because Splunk has plausibly pleaded a violation of DMCA Section 1202 against CEO 10 Sharp, the motion to dismiss as to that claim is DENIED. 12 For the foregoing reasons, the motion to dismiss is GRANTED IN PART and DENIED IN 13 PART. The motion is GRANTED as to all claims for willful and indirect patent infringement 14 against Cribl, as well as all claims for infringement of the five asserted patents against Cribl 3 15 based on their ineligibility. The motion is DENIED as to all claims for indirect copyright 16 infringement against Cribl and CEO Sharp, as well as the claim for violation of DMCA Section 3 17 1202 against CEO Sharp. Alleged infringers’ answer is due in FOURTEEN DAYS. 18 Splunk may move for leave to amend its complaint. Such motion must be filed within 19 FOURTEEN DAYS and include as an exhibit a redlined version of the proposed amendment that 20 clearly identifies all changes. This order highlighted certain deficiencies, but merely adding 21 sentences to address these deficiencies may not justify leave to amend. If Splunk moves for 22 leave to file an amended complaint, it should be sure to plead its best case and consider all 23 criticisms made by alleged infringers, including those not reached by this order. 25 26 Dated: March 17, 2023. Pee 27 A = ILLIAM ALSUP 28 UNITED STATES DISTRICT JUDGE

Splunk Inc. v. Cribl, Inc., (N.D. Cal. 2023).

Pincite

Splunk Inc. v. Cribl, Inc. (Splunk Inc. v. Cribl, Inc.) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Opinion

Related