Splunk Inc. v. Cribl, Inc.

• Court: District Court, N.D. California
• Decided: March 17, 2023
• Docket: 3:22-cv-07611
• Status: Unknown

Opinion

1 2 3 4 5 6 UNITED STATES DISTRICT COURT 7 NORTHERN DISTRICT OF CALIFORNIA 8

10 SPLUNK INC., 11 Plaintiff, No. C 22-07611 WHA

12 v.

13 CRIBL, INC. and CLINT SHARP, ORDER RE MOTION TO DISMISS 14 Defendants.

15 16 17 INTRODUCTION 18 In this intellectual property dispute, alleged infringers move to dismiss patent and 19 copyright claims. For the following reasons, the motion is GRANTED IN PART and DENIED IN 20 PART. 21 STATEMENT 22 Patent and copyright owner Splunk Inc. was founded in 2003 and runs a platform for 23 analyzing large volumes of data. Its flagship product, Splunk Enterprise, “ingests real-time 24 flows of machine data from disparate sources across a distributed environment and indexes that 25 data, regardless of its source or format.” This allows customers to “interact with their data 26 through an interface from which they can generate graphs, reports, alerts, dashboards, and 27 visualizations,” and “monitor and react to their data in real time” (Compl. ¶¶ 1, 17). 1 Splunk Enterprise is customizable. Recognizing that customers use different types of 2 data in different ways, Splunk “supports and encourages third parties to develop on top of the 3 Splunk platform,” “extending the features and functionality.” Through its Technology 4 Alliance Partner (“TAP”) program, Splunk grants partners a license to use its software 5 development tools and a limited license to run Splunk Enterprise software for related 6 development (Compl. ¶¶ 22, 24–25). 7 According to Splunk, some Splunk software is specifically provided for partners to use, 8 such as the “HEC” protocol, which enables partners to send data to, or receive data from, a 9 running copy or “instance” of Splunk Enterprise. Other Splunk software is apparently 10 proprietary, such as the “S2S” or “Splunk-to-Splunk” protocol, which Splunk uses to send data 11 to, or receive data from, Splunk Enterprise and other Splunk software. Splunk alleges that it 12 “does not support use of S2S by third parties, does not publish S2S’s source code, and does not 13 document S2S in a manner that facilitates third-party use of this protocol” (Compl. ¶¶ 31–32). 14 Alleged infringer Cribl, Inc. was founded in 2017 by three former Splunk employees, 15 including alleged infringer and Cribl CEO Clint Sharp. In 2018, Cribl launched its first 16 product, now known as Stream, and joined the TAP program by entering into a TAP agreement 17 with Splunk. Stream and other Cribl products interoperate with Splunk Enterprise. As 18 explained by Splunk with respect to Stream, “Stream sits between a Splunk customer’s sources 19 of machine data and that customer’s Splunk Enterprise instance. Instead of flowing directly 20 from data sources into Splunk Enterprise, data flows into Stream. Stream can then filter this 21 data before it is passed along to Splunk Enterprise, with a goal of reducing the total volume of 22 data a customer adds to its Splunk Enterprise instance” (Compl. ¶¶ 2–3, 39, 46, 51). 23 In November 2021, Splunk terminated Cribl’s membership in the TAP program, thereby 24 terminating the TAP agreement. Roughly one year later, it filed an 85-page complaint against 25 Cribl and CEO Sharp alleging patent infringement, copyright infringement, and other unfair 26 business practices. According to Splunk, Cribl has infringed patents awarded to Splunk for its 27 foundational innovations, developed and marketed its software by making unlicensed copies of 1 against Splunk. Meanwhile, CEO Sharp “actively participated” in the misappropriation. 2 Among other actions, he purportedly posted a derivative of Splunk’s copyrighted source code 3 — “go-S2S” — to his personal webpage on code hosting platform GitHub before leaving 4 Splunk to found Cribl with this source code, replacing Splunk’s copyright headers with a false 5 open-source license to obscure unlawful copying before taking the code offline in December 6 2021 (Compl. ¶¶ 2, 4, 33–37, 42–44, 67; see generally Compl. ¶¶ 119–338). 7 Cribl and CEO Sharp (together, “alleged infringers”) now move to dismiss patent and 8 copyright claims under Rule 12(b)(6) of the Federal Rules of Civil Procedure. Specifically, 9 they move to dismiss: (1) all claims for willful and indirect patent infringement against Cribl; 10 (2) all claims for patent infringement against Cribl based on ineligibility of all asserted patents; 11 (3) all claims for indirect copyright infringement against Cribl and CEO Sharp; and (4) a claim 12 for violation of the Digital Millennium Copyright Act Section 1202 against CEO Sharp. The 13 claims will be taken up in turn. This order follows full briefing and oral argument. 14 ANALYSIS 15 To survive a motion to dismiss, a complaint must plead “enough facts to state a claim to 16 relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A 17 claim has facial plausibility when the plaintiff pleads factual content that allows the court to 18 draw the reasonable inference that the defendant is liable for the misconduct alleged.” 19 Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 570). At the pleading 20 stage, a district court “accept[s] all factual allegations in the complaint as true and construe[s] 21 the pleadings in the light most favorable to the nonmoving party.” Knievel v. ESPN, 393 F.3d 22 1068, 1072 (9th Cir. 2005). A “legal conclusion couched as a factual allegation,” however, 23 may be disregarded. Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 555). 24 1. WILLFUL AND INDIRECT PATENT INFRINGEMENT. 25 Splunk alleges that Cribl committed willful patent infringement and both forms of 26 indirect patent infringement (induced and contributory infringement) of all five asserted 27 patents: U.S. Patent Nos. 9,208,206; 9,762,443; 10,805,438; 10,255,312; and 9,838,467. 1 According to alleged infringers, Splunk’s willful and indirect infringement claims 2 against Cribl should be dismissed because Splunk has not pleaded that Cribl had pre-suit 3 knowledge of the asserted patents, let alone pre-suit knowledge of their infringement. Alleged 4 infringers emphasize that Splunk has failed to assert that it sent Cribl a notice letter, much less 5 that anyone at Cribl was personally aware of the asserted patents. Instead, Splunk “merely 6 implies” that Cribl gained knowledge of the asserted patents because its co-founders and some 7 of its employees previously participated in Splunk’s patent program (Br. 1). According to 8 alleged infringers, this is insufficient when “general knowledge of a patentee’s portfolio does 9 not plausibly allege actual notice of a particular patent” (Br. 1–2). Splunk counters that it has 10 alleged pre-suit knowledge not based on general knowledge of a patent portfolio but rather 11 “extensive factual allegations,” such as: 12 (1) Cribl was founded by ex-Splunkers who managed Splunk software products that practice the patents Cribl infringes (e.g., 13 Compl. ¶¶ 89–93, 116–118); (2) this software is marked as practicing the asserted patents (id. ¶ 114); (3) Cribl has been a 14 customer/user of the software since it was founded (id. ¶¶ 22–29; 69–78); (4) Cribl copied this software (id. ¶ 118); and (4) [sic] 15 Cribl’s founders and employees were aware of Splunk’s patent- marking page when it copied and used this software (id. ¶¶ 116– 16 118). 17 (Opp. 22–23). This order agrees with alleged infringers that such allegations are too attenuated 18 to support a showing of pre-suit knowledge. 19 To establish willful infringement, a patent owner must prove knowledge of the asserted 20 patents and knowledge of their infringement. Although the jury decides willfulness, 21 willfulness only goes to the jury if it was properly framed by the pleadings. Seeing that no 22 additional pleading requirements have been expounded since the legal standard for willful 23 infringement was clarified in Halo Electronics, Inc. v. Pulse Electronics, Inc., 579 U.S. 93 24 (2016), knowledge of the asserted patents and knowledge of their infringement should be 25 pleaded with plausibility. Sonos, Inc. v. Google LLC, 591 F. Supp. 3d 638, 643 (N.D. Cal. 26 2022), leave to appeal denied, 2022 WL 1486359 (Fed. Cir. May 11, 2022). Because both 27 forms of indirect infringement also require such knowledge, the “foregoing ground rules 1 parallel issues for indirect infringement.” Id. at 647. In other words, knowledge of the 2 asserted patents and knowledge of their infringement should be pleaded with plausibility for 3 indirect infringement claims as well. 4 Prior orders have explained the need for a notice letter in almost all circumstances. See 5 id. at 643–44; Sonos, Inc. v. Google LLC, 2022 WL 2046828, at *3 (N.D. Cal. June 7, 2022); 6 MasterObjects v. Amazon.com, Inc., 2021 WL 4685306, at *7 (N.D. Cal. Oct. 7, 2021). The 7 practice of establishing pre-suit knowledge through a cease-and-desist letter that calls out 8 patent claims and how accused products infringe should be encouraged to give an alleged 9 infringer a meaningful opportunity to cease infringement or get a license before a lawsuit 10 commences. (That such a letter may provoke a declaratory relief suit in a district of that 11 alleged infringer’s choosing does not excuse the failure to send one.) Although there are 12 circumstances in which pre-suit knowledge is properly alleged despite the absence of a notice 13 letter, “the complaint will generally not be adequate to serve as notice for either willful or 14 indirect infringement.” Sonos, 591 F. Supp. 3d at 648. 15 Such is the case here. That Cribl was founded by ex-Splunkers who once managed 16 products which practice patents Cribl allegedly infringes does not give rise to a plausible 17 inference that Cribl’s founders were aware of the five specific asserted patents and that they 18 were infringing them. This knowledge would be above and beyond what could reasonably be 19 expected of senior technical employees — at least when they were not named inventors of the 20 asserted patents. Similarly, that Splunk software directed those who used it to a patent- 21 marking webpage listing Splunk patents and corresponding Splunk products does not give rise 22 to a plausible inference that Cribl’s founders or employees were aware of the five specific 23 asserted patents and that they were infringing them. The implication seems to be that these 24 individuals would affirmatively investigate which of over 1,000 Splunk patents their Splunk 25 software practiced even though Cribl had received a license to use that Splunk software 26 pursuant to the TAP agreement. Again, this is untenable. It is especially untenable upon 27 review of the patent-marking webpage, excerpts of which are provided below (Compl. Exh. P). 1 under ““Splunk® Apps,” and one patent-in-suit is listed under “Splunk® Technology.” They 2 are highlighted for ease of reference. 3 4 Splunk® Enterprise 10,073,454, 10,019,226, 10,019,496, 10,0397,.351, 10,049,473, 10,055,086, 10,067,626, 10,061,807, 10061 821, 10,061,824, 10,067,876, 5 10,067 44, 10,069,972, 10,083,190, 10,091 358, 10,095,397, 10,005,741, 10,108,403, 10,174,663, 10.1027 258, 10,193,805, 10,139,997, 10,142,412, 10,152,773, 10,162,863, 10,164,994, 10,169,405, 10,169,434, 10,178,152, 10,185,708, 10,185,740, 10,193,916, 10,209,842, 6 10,204,093, 10,204,792, 10,216,799, 10216,862, 10,223,423, 10,229,826, 10,225,196, 10,229,150, 10296.221, 10,295,545, 10,255,409, 10,235,418, 10,255,431, 10,235,460, 10235,804, 10,242,099, 10242,0660, 10,242,109, 10,245,818, 10244,1 14, 10,255,310, Mai) 10,255,422, 10,261,673, 10,266,652, 10,268,755, 10,282,455, 10,282,463, 10,296,616, 10,903,544, 10,310,708, 10,318,3960, 10,918,535, 7 TOS 18,537, 10,318,541, 105918553, 10318555, 10 320,877, 10924, 957, 10,326,583, 10,921,720, 10,399,149, 10,399,162, 1,346,957, 10,959,957, 10,962,041, 10,972,722, 10,375,098, 10,979,095, 10,380,122, 10,987,996, 10,987,429, 10,307,448, 10,988,067, 10,994,002, 8 10,394,046, 10402 384, 10,403,041, 10409794, 10,419,404, 10,429,595, 10,444,956, 10,459,938, 10459999, 10460255, 10,460,579, 10,467,263, 10474674, 10,474,682, 10.496,605, 10496, 991, 10,509,698, 10,505,084, 10,500,555, 10.509. 784, 10,500, 794, 10,575,469, 10,529,830, 10,528,607, 10,534,791, 10,596,356, 10,540,921, 10,545,798, 10,545,964, 10,552,726, 10,558,614, 10,555,654, 10,565,196, 9 10,565,220, 10,572,611, 10,5 Po ,007, 10.5 79.048, 10,585,051, 10,555,990, 10,585,019, 10,592,094, 105045 10,599,505, 10,006,810, 10,606,856, 10,606,887, 10,607,150, 10,614,132, 10,642,052, 10,650,069, 10,656,924, 10,657,146, 10,659,609, 10,478,696, 10,678,767, 10 10,675,803, 10,079,142, 10,685,001, 10685279, 10,086,394, 10,693,145, 10,098,777, 10,690,095, 1O.698.697, 10,098,900, 10,705,695, 10,713,245, 10,713,269, 10,713,914, 10,719,493, 10,719,525, 10,725,676, 10,726,030, 10,726,037, 10,726,354, 10,726,589, 10,735,492, 10,740,919, 10,740,970, 10,747,742, 10,748,290, 10,761,687, 10,762,081, 10,762,097, 10,760,786, 10,768,798, 10,769,178, 10,776,194, 1 1 10,776,950, 10,778,710, 10,776,961, 10,769,318, 10,783,324, 10,995,555, 10,798,148, 10,802, 797, 10810221, 10,810,791, 10,810,796, 10,812,514, 10,917,544, 10,817,757, 10,898,605, 10,846,916, 10,859,082, 10,853,500, 10,853,982, 10,859,209, 10,853,999, 10,855,712, x 12 10,855,793, 10,660,537, 10,660,591, 10,860,592, 10,860,624, 10,661,202, 10,666,994, 10,877,969, 10.677 S86, 10,87 7987, 10,665,026, 10,655,125, 10,887,320, 10,891,281, 10.891 284, 10,696,195, 10,896,182, 10,901,811, 10,908,987, 10.909.140, 10,900,151, 10,915,583, 10,929,163, 10,929,560, 10,996,643, 10.042 774, 10,949,419, 10,956,278, 10,956,481, 10,956,024, 10,977,293, 10,977,206, 10,999,786, L& 13 10,984,013, 10,985,970, 10,997,138, 10,997,191, 11,003,337, 11,005,044, 11,003,675, 11,003,682, 11,003,687, 11,003,691, 11,010,214, = 11,070,990, 11,010,412, 141,070,970, 11,076,821, 11,090,173, 11,090,192, 11,090,254, 11,036,566, 11,096,567, 11,097,942, 11,042,510, 14 11,042,575, 11,042,599, 11,042,545, 11,042,591, 11,042,697, 11,055,300, 11,061,918, 11,062,016, 11,068,323, 11,068,452, 11,074,216, gy 11,074,289, 11,075,825, 11,087,236, 11,099,476, 11,093,897, 11,095,690, 11,100,150, 11,106,601, 11,106,713, 11,113,942, 11,119,728, © 14,119,899, 11,719,902, 14,120,944, 11,126,477, 19,199,194, 14,198,210, 11,144,521, 11,144,520, 11,144,608, 11,151,085, 11,151,137, 15 11,157,446, 11,759,397, 11,163,599, 11,169,738, 17,170,016, 11,770,129, 11,172,065, 11,176,146, 11,182,367, 11,184 467, 11,158,550, 11,789,083, 17,790,422, 11,194,794, 11200246, 11,204,817, 11,270,072, 11,2710325, 11,276,591, 11,222,014, 11,226,977, 11227,208, 11,231,840, 11,252,124, 11,232,146, 11,258,035, 11,298,057, 11,244,247, 11,249,710, 11,249,971, 11,250,068, 11,262,224, 11,269,476, A 16 11,269,808, 11,208,291, 11,286,289, 11,294,559, 11,906,064, 11,310,373, 11,914,793, 11,914,744, 11,314,758, 11,914,759, 11,914,761, 44,514,799, 17,516,902, 14,924,911, 11,941,129, 11,947,577, 11,947,695, 11,948,204, 171,949,947, 11,254,206, 17,994,965, 11,975,071, a 17 11,379,479, 11,579,508, 11,979,630, 11,366,109, 11,566,195, 11,992,590, 11,392,604, 11,994,767, 11,409,395, 11,409,758, 11,471,804, 14,422,874, 11,423,216, 17,429,608, 7,937,344, 9,112,425, 6,412,696, 8,575,969, 9,576,008, 6,548,961, 6,566,336, 9,583,631, 8,589,204, oO 8,580,921, 8,589 375, 8,509,403, 6,599,432, 8,589,876, 8,682,856, 6,682,006, 8,602,925, 6,694,450, 6,745,109, 8,751,499, 8,751,529, 2 18 8,751,963, 8,756,262, 9,756,593, 8,756,614, 8,788,459, 8,788,525, 8,788,526, 6,825,664, 8,904,389, 8,909,642, 8,943,056, 8,972,992, 8,977,638, 8,983,994, 8,990,784, 8,990,245, 9,002 854, 9,075,716, 9,091,955, 9,047,246, 9,087,090, 9,124,012, 9,128,779, 9,128,916, 19 9,128,980, 9,128,985, 9,129,028, 9,129,041, 9,190,971, 9,142,049, 9,162,682, 9,162,929, 9,160,798, 9,177,002, 9,185,007, S208 206, 9,229,985, 9,245,039, 9,256,507, 9,280,594, 9,292,590, 9,296,805, 9,317,582, 9,361,357, 9,384,261, 9,417,774, 9,419,870, 9,426,045, 9,430,485, 9,490,574, 9,497,022, 9,442,987, 9,600,765, 9,614,175, 9,582 557, 9,582,585, 9,609,012, 9,594,545, 9,694 789, 9,594,614, 20 9,607,414, 9,645,975, 9,646,398, 9,667,640, 9,733,974, 9,740,755, 9,740,788, 9,747,316, 9,753,909, 9,753,974, 9,754,459, 9,754,395, 9,767,112, 9,767,122, 9,613,528, 9,61 7,654, 9,617,662, 9,696,596, 9,696,501, 9,696,625, 9,696,674, 9,642,160, 9,642,492, 9,645,598, 2 1 9,916,946, 9,921,790, 9,921,732, 9,922,097, 9,922,065, 9,922,066, 9,922,067, 9,922,082, 9,022,084, 9,922,097, 9,922,099, 9,922,102, 9,922,114, 9,928,262, 9,942,318, 9,977,803, 9,978,127, 9,983,912, 9,983,954, 9,984,128, 9,984,129, 9,990,386, 9,990,423, 9,990,769, 9,992,208, 9,996,571 22 23 24 25 26 27 28 fn

Splunk® Apps 2 The following patents as well as other apply to one or more Sphenk Apps: 10,007,770, 10,049,160, 10,174,665, 10,027 279, 10,152,480, 10,205,649, 10,243,818, 10,257 050, 10.264,106, 10,910,708, 10,954,085, 3 10,545,583, 10,353,965, 10,560,196, 10366,101, 10,374,883, 10,39 79,895, 10,380,799, 10,582,599, 1O S87 408, 10499,922, 10,459,819, 10,460,255, 10,462,002, 10,462,004, 10409 344, 10,474, F235, 10,505,784, 10,515,409, 10,523,521, 10.529,538, 10,596,951, 10,536,356, 10,552,287, 10,564,622, 10,567,557, 10585,851, 10,585,951, 10,592,522, 10,592,525, 10,597,561, 10,592 562, 10,597,563, 10,599,724, 4 10,599, f24, 10,604,298, 10,69 1262, 106 7H 804, 10,084,994, 10,601 525, 10,095, 10,693,743, 10 POO SSR, 10,701,191, 10,719,432, 10,726,009, 10,726,080, 10,747,816, 10,754,698, 10,761,687, 10,761,819, 10,762,049, 10,769,163, 10,775,976, 10,776,140, 10,776,355, 5 TOP Pe, TOP al 1, 10, P95 Fe, POO, 10,860,590, TOA00,618, 10,860,005, 10,060,366, 10685,049, 10,904,080, 10,909,125, 10,909,182, 10,916,063, 10,977,389, 10,922,341, 10,922,625, 10,929,163, 10,929,415, 10,930,565, 10.942 597, 10,951,474, 10,956,462, 10,966,415, 10,970,298, 10,977,260, 10,997,180, 10,997,192, 11,003,475, 11,004,714, 11,070,236, 11,010,495, 11,023,465, 11,073,504, 6 11,029,539, 11096456, 11,074,152, 11,0 75.825, 117,080,945, 11,086,259, 11,086,890, 11,066,097, 11,087 236, 11,093,518, 11,003,564, 17,700,150, 17,700,772, 11,106,440, 17,706,681, 17,106,794, 11,108,659, 11,773,301, 11,113,953, 11,115,505, 17,126,632, 11,127,229, 7 11,132,975, 11,744,185, 11,151,125, 11,057 498, 11,159,597, 11,169,599, 11,163,758, 11,169,900, 11.7 96208, 11,194,552, 11,194,554, 11210278, 11,210,622, 11,276,453, 11218366, 11,222,066, 11,252,100, 11,292,125, 11,238,012, 112358,048, 11,298,112, 112435,963, 11,245,587, 11,250,056, 11,250,971, 11,252,056, 11,256,497, 11,269,229, 11,269,876, 11,269,908, 11,269,099, 11,281,643, 11,281,706, 8 11,288,231, 11,294,941, 11,296,951, 11908,163, 11,914,613, 11,914,737, 11,314,753, 11,921,921, 11,441,131, 11,586,127, 11,592,654, 11,392,655, 11,404,350, 11,405,501, 11,409,756, 11,416,278, 11,416,528, 11422686, 11,429,627, 11416505, 6,683,467, 6,738,587, 9 6,798,629, 6,751 466, 6,795,225, 6 904,569, 6972992, 9,015,016, 043,392, 9,047,181, 9,052,938, 9,122,646, 9,142,049, 9,164, 9,185,007, 9,275,998, 9,323,557, 9477, FT4, 9,419,870, 9,426,045, 9,471,562, 9,495,187, 9,514,189, 9,594,828, 9,596,255, 9,735,974, 9,754,995, 062443) 9,036,502, 9,838,512, 9,916,367, 9,916,479, 9,916,385, 9,921,733, 9,923,767, 9,994,309, 9,995,064, 9,940,496, 10 9,959,015, 9,990,265, 0946,024, 046,025, 046,026

12 Splunk® Technology ‘a 3 The following patents as Well as others apply to Splunk Technology

“a 10,026,204, 10,055,312, 10,061,680, 10.089.143, 10,115,126, 10,204,450, 10,388,067, 10,403,041, 10,409,668, 10,419,525, 10,425,900, 14 10,432,497, 10,460,579, 10,469,546, 10462.493, 10,497,019, 10,545,836, 10,554,788, 10,599,529, 10.628.609, 10,625,771, 10,652,261, 10,657,650, 10,684,954, 10,692,299, 10, 7S5.296, 10,740,970, 10,7 76,818, 10, 7H9279, 10,759,615, 10,810,796, 10,891,648, 10,687,157, © 10,891,792, 10,908,772, 10,971,369, 10,922,495, 10,922,892, 10,937 052, 10,998,654, 10,949,253, 10949420, 10,977 222, 11,070,970, 15 141,007,764, 11,023,547 1, 11,037,192, 17,048,760, 17,07d 152, 141,080,644, 11,702,095, 14,1975,294, 11,727 225, 11,144,556, 11,145,129, 3 11,182,576, 11,794,647, 11,272,207, 11.216,511, 11,217,023, 11,226,964, 11,297,813, 11,237,922, 11,240,348, 11,263,268, 11,269,859, 16 11,269,871, 11,276,296, 11,276,240, 11.268,379, 11,302,083, 11,905,503, 11,316,749, 11,379,670, 11,266,113, 11,396,158, 11,409,645, a 11,470,409, 11,476,285, 11,430,196, 6,976,036, 6,990,637, 9,009,539, 9,208,000, 9,513,177, 9,024,022, 9,555,006, 9,614,021, 9,660,930, 9,747,152, 9,753,818, 9,007,192, 9,036,358, 9,835,292, 9,058,345, Sea6 7, 9,853,946, 9,916,326, 9,990,769

18 19 Finally, even assuming Cribl knowingly used and copied Splunk software after Splunk 20 terminated the TAP agreement, this does not suggest that Cribl was aware of the five specific 21 asserted patents and that it was infringing them. That Cribl employees could have visited the 22 patent-marking webpage under such circumstances is insufficient to create a plausible 23 inference of pre-suit knowledge (or “willful blindness”). 24 This order recognizes that one circumstance in which willful and indirect patent 25 infringement may be properly alleged despite the absence of a notice letter is when the alleged oa: . 26 infringer “may have had a prior license, but the license ran out.” Sonos, 591 F. Supp. 3d 27 at 644. The license that ran out here, however, derives from the TAP agreement between

=

1 Splunk and Cribl. It would be unfair to suggest that Cribl’s pre-suit knowledge of the five 2 specific asserted patents could derive from the termination of this agreement. 3 The agreement itself expressly states, inter alia, that Splunk grants Cribl “a non- 4 exclusive, non-transferable, worldwide, non sublicenseable license during the Term to 5 download (and make up to five (5) copies) and use the Splunk Software” (Compl. ¶ 27 6 (quoting Exh. B § 3.3)). In other words, pursuant to the TAP agreement, Cribl received a 7 software license — an authorization to use Splunk software under Splunk’s intellectual 8 property rights. But the TAP agreement and its license grant never enumerate those 9 intellectual property rights or name the patents-in-suit. The only use of the word “patent” in 10 the agreement is in reference to “remov[ing] or obscur[ing] any copyright, trademark, patent, 11 or other proprietary notices, legends or symbols from the Splunk Software,” which is 12 forbidden. The agreement otherwise only broadly refers to Splunk’s “intellectual property” 13 and “intellectual property rights,” which “nothing in the Agreement transfers or assigns” (Exh. 14 B §§ 4, 5.1). If Cribl had a license that expressly covered the five specific asserted patents, and 15 that license ran out, it would give rise to a plausible inference that Cribl had pre-suit 16 knowledge of the five specific asserted patents and their infringement. But the TAP agreement 17 was no such license. 18 In sum, Splunk’s allegations are insufficient to plead pre-suit knowledge, as required for 19 willful and indirect patent infringement. The motion to dismiss as to Splunk’s willful and 20 indirect patent infringement claims against Cribl is therefore GRANTED. This order does not 21 reach alleged infringers’ alternative arguments regarding Splunk’s allegedly insufficient 22 pleadings of specific intent and lack of substantial non-infringing uses. 23 2. INELIGIBILITY OF ASSERTED PATENTS. 24 Next, alleged infringers move to dismiss all of Splunk’s patent claims against Cribl based 25 on ineligibility of the five asserted patents under Section 101 of the Patent Act. 35 U.S.C. 26 § 101. When there are no plausible factual disputes after drawing all reasonable inferences in 27 favor of the non-movant, patent eligibility can be determined at the Rule 12 stage. Coop. Ent., 1 Inc. v. Kollective Tech., Inc., 50 F.4th 127, 130 (Fed. Cir. 2022). This order finds that 2 appropriate here. 3 A. THE LEGAL STANDARD. 4 Section 101 addresses the preemption concerns underlying patent law. It provides that 5 whoever “invents or discovers any new and useful process, machine, manufacture, or 6 composition of matter, or any new and useful improvement thereof, may obtain a patent 7 therefor, subject to the conditions and requirements of this title.” 35 U.S.C. § 101. The 8 implicit corollary is that laws of nature, natural phenomena, and abstract ideas are not patent 9 eligible. Mayo Collab. Servs. v. Prometheus Labs., Inc., 566 U.S. 66, 70–71 (2012). After all, 10 “monopolization of those tools through the grant of a patent might tend to impede innovation 11 more than it would tend to promote it.” Ibid. 12 “Short and unadorned, [Section] 101 appears deceptively simple on its face, yet its proper 13 application to computer-implemented inventions and in various other fields of technology has 14 long vexed [the Federal Circuit] and other courts.” CLS Bank Int’l v. Alice Corp. Pty., 15 717 F.3d 1269, 1276 (Fed. Cir. 2013) (en banc) (Judge Alan D. Lourie, concurring), aff’d, 573 16 U.S. 208 (2014). In Alice Corp. Pty. v. CLS Bank Int’l, 573 U.S. 208 (2014), the Supreme 17 Court set out our two-step inquiry for evaluating patent claims under Section 101. Patent 18 eligibility is assessed by reference to Alice and cases engaging in the Alice two-step analysis. 19 See In re Killian, 45 F.4th 1373, 1383 (Fed. Cir. 2022). 20 At step one, the district court evaluates whether patent claims are directed to an abstract 21 idea. Alice, 573 U.S. at 218. The Federal Circuit has explained that the district court should 22 consider whether the claims “focus on a specific means or method that improves the relevant 23 technology” or are instead “directed to a result or effect that itself is the abstract idea and 24 merely invoke generic processes and machinery.” Apple, Inc. v. Ameranth, Inc., 842 F.3d 25 1229, 1241 (Fed. Cir. 2016). The district court should also consider whether the claims 26 purport to improve the functioning of a computer or merely require generic computer 27 implementation. Enfish, LLC v. Microsoft Corp., 822 F.3d 1327, 1338–39 (Fed. Cir. 2016); 1 with the benefit of a computer are directed to abstract ideas, as are those that merely gather, 2 analyze, and display information. See Alice, 573 U.S. at 219; Intell. Ventures I LLC v. Cap. 3 One Fin. Corp., 850 F.3d 1332, 1340–41 (Fed. Cir. 2017) (Capital One); Intell. Ventures I 4 LLC v. Symantec Corp., 838 F.3d 1307, 1313–14 (Fed. Cir. 2016) (Symantec); Elec. Power 5 Grp., LLC v. Alstom S.A., 830 F.3d 1350, 1354 (Fed. Cir. 2016). When there are “close calls 6 about how to characterize what the claims are directed to,” “an analysis of whether there are 7 arguably concrete improvements in the recited computer technology could take place under 8 step two.” Enfish, 822 F.3d at 1339. 9 At step two, if the patent claims are directed to an abstract idea, the district court 10 evaluates whether the claimed elements recite an inventive concept that transforms an 11 otherwise abstract idea into a patent-eligible invention. Alice, 573 U.S. at 221. A patent claim 12 must do more than state an abstract idea and say “apply it” or “apply it with a computer.” Id. 13 at 223–24. “[S]imply appending conventional steps, specified at a high level of generality, to 14 laws of nature, natural phenomena, and abstract ideas cannot make those laws, phenomena, 15 and ideas patentable.” Mayo, 566 U.S. at 82. Thus, the district court should consider whether 16 the claims merely recite generic computer processes and machinery or whether the non-generic 17 arrangement of such processes and machinery gives rise to an inventive concept. Bascom 18 Glob. Internet Servs., Inc. v. AT&T Mobility LLC, 827 F.3d 1341, 1349–50 (Fed. Cir. 2016). 19 The step two “[i]nquiry therefore must turn to any requirements for how the desired result is 20 achieved.” Two-Way Media Ltd. v. Comcast Cable Commc’ns, LLC, 874 F.3d 1329, 1339 21 (Fed. Cir. 2017) (quoting Elec. Power Grp., 830 F.3d at 1355) (emphasis in original). 22 Crucially, the district court may not rely on conclusory statements from the complaint or 23 “technological details set forth in the patent’s specification and not set forth in the claims to 24 find an inventive concept.” Symantec, 838 F.3d at 1322 (citation omitted); see Iqbal, 556 U.S. 25 at 678 (citing Twombly, 550 U.S. at 555). Although the pleadings and the specification can 26 illuminate the inventive concept, they cannot supply it. See Am. Axle & Mfg., Inc. v. Neapco 27 Holdings LLC, 967 F.3d 1285, 1293 (Fed. Cir. 2020); ChargePoint, Inc. v. SemaConnect, Inc., 1 A. THE REPRESENTATIVE CLAIMS. 2 The claims mapped in Splunk’s complaint and analyzed in alleged infringers’ motion to 3 dismiss are claim 1 of each asserted patent (see Compl. ¶¶ 120–22, 148–50, 175–77, 204–06, 4 227–29; Br. 7 n.3, 11 n.5, 15 n.6, 17 n.7, 21 n.10). In its opposition, Splunk argues that these 5 claims are “not representative of all claims in the patents, given meaningful differences in 6 other claims” (Opp. 10) (emphasis in original). Upon review, this order disagrees. 7 In carrying out an Alice analysis, the district court need not address every claim of the 8 patents-in-suit. It may select representative claims where the patentee “does not present any 9 meaningful argument for the distinctive significance of any claim limitations not found in the 10 representative claim” or other claims recited in a patent are “substantially similar and linked to 11 the same abstract idea.” Berkheimer v. HP Inc., 881 F.3d 1360, 1365 (Fed. Cir. 2018); Content 12 Extraction & Transmission LLC v. Wells Fargo Bank, Nat’l Ass’n, 776 F.3d 1343, 1348 (Fed. 13 Cir. 2014) (citation omitted). Splunk mapped the first claim of each asserted patent — and 14 only the first claim of each asserted patent — in the complaint. Its cursory comments on a few 15 independent and dependent claims in the opposition do not present meaningful arguments for 16 meaningful differences. Accordingly, this order finds claim 1 of each asserted patent 17 representative. Even so, it will briefly explain why those scattered other claims mentioned in 18 Splunk’s opposition are substantially similar and linked to the same abstract idea as the 19 representative claims in its analysis of those representative claims. 20 Although Splunk argues it would be premature to address patent eligibility at this 21 juncture, dropping a footnote that says “analysis of the total number of infringed claims in this 22 case is ongoing” and that estimates “disclosures will identify over 50 [infringed] claims” 23 cannot postpone this day of reckoning (Opp. 10 n.2). Indeed, this action is not analogous to 24 Krush Technologies LLC v. Zoom Video Communications, Inc., 2019 WL 8107871 (N.D. Cal. 25 July 23, 2019), where the undersigned declined to resolve Section 101 issues at the Rule 12 26 stage. Here, the complaint specifies claims that are infringed, and the question of eligibility is 27 not intertwined with questions of fact, as will be discussed in detail below. Id. at *2. 1 Having determined that claim | of each asserted patent is representative, this order takes 2 up the representative claims. 3 B. THE ’206 PATENT. 4 Let’s begin with the ’206 patent, entitled “Selecting Parsing Rules Based on Data 5 Analysis.” The representative claim discloses a method for “selecting a portion of raw data 6 from at least one data source”; “analyzing [it] to find a match . . . corresponding to a parsing 7 rule in a plurality of stored parsing rules”; “parsing [it] into a set of searchable, time-stamped 8 events .. . using the parsing rule”; “causing display of a preview . . . in a graphical user 9 interface”; and “in response to user input received via the graphical user interface,” 10 “processing” at least some data not in the selected portion “using the parsing rule . . . to create 11 searchable, time-stamped events” (°206 patent, col. 20:46—53, 57-59, 60-63; see generally id. 12 at col. 20:45-67). The final limitation is that the method “is performed by one or more 13 computing devices” (id. at col. 20:66-67). 14 Translating the jargon, “raw data” refers to data before it has been processed (id. at col. 3 15 3:24-26). Although “parsing rule” is not expressly defined, the specification and complaint 16 provide numerous demonstrative examples (see, e.g., id. at col. 3:14—20; Compl. §] 187). The 3 17 complaint, for instance, points to a parsing rule in Cribl’s documentation that separates raw 18 data into events by looking for a new line symbol (“1”) and a timestamp (e.g., “2021/10/09 19 10:19:15”): 20 21 pc ES. 32,3

Parsed raw data with timestamp, Complaint, 1187 25 26 (Reply Br. 2 (citing Compl. { 187)). 27 Per Alice step one, alleged infringers argue that the representative claim is directed to a 28 patent-ineligible abstract idea of “selecting a subset of test data from a larger data set,”

1 “applying a rule to look for a pattern match within the test data,” and “if the rule works, 2 applying that rule to the larger data set” (Br. 6). They emphasize that this mental process has 3 been performed, albeit less efficiently, by humans for many years, and that any alleged 4 improvement results from “user input” (determining the stored parsing rule works before 5 applying it to the larger data set) (Br. 7–8). Splunk counters that this claim and others are not 6 directed to an abstract idea because they are “‘necessarily rooted in technology in order to 7 overcome a problem specifically arising in the realm of’ computer search engine indexes” 8 (Opp. 10–11 (quoting SRI Int’l, Inc. v. Cisco Sys., Inc., 930 F.3d 1295, 1303 (Fed. Cir. 2019)). 9 According to Splunk, mental processes like pattern-matching “bear no resemblance to software 10 that improves the construction of search engine indexes from raw machine data” (Opp. 11). 11 Recall, however, that unclaimed features are irrelevant to the Alice analysis. Am. Axle & 12 Mfg., Inc., 967 F.3d at 1293; ChargePoint, Inc., 920 F.3d at 769. The specification explains 13 that if “improper index data may be added to an index store it may pollute the index reducing 14 the quality of search results that may be produced” (’206 patent, col. 1:38–40). But the claim 15 language itself does not describe technologically rooted improvement. Although Splunk states 16 in its opposition that “the claims describe software techniques that better define events before 17 indexing occurs, in conjunction with improved rule selection,” the only recited improvement is 18 supplied by the user (Opp. 11). 19 Note the representative claim does not specify how to select parsing rules based on data 20 analysis. The rules are already “stored,” and the user decides whether parsing a broader 21 portion of data using a stored rule is appropriate after parsing a smaller portion of data using 22 that stored rule. The claim does not “focus on a specific means or method that improves the 23 relevant technology” but is rather “directed to a result or effect that itself is the abstract idea 24 and merely invoke[s] generic processes and machinery.” Apple, 842 F.3d at 1241 (citation 25 omitted). It is the user who “better define[s] events before indexing occurs” and “improve[s] 26 rule selection,” not any software technique disclosed. 27 What’s more, a “software technique” is not even disclosed here. Unlike in Enfish, the 1 merely requires generic computer implementation “wherein the method is performed by one or 2 more computing devices.” This claim “at most recite[s] abstract data manipulation” and is 3 “recited at such a level of result-oriented generality that [it] amount[s] to a mere 4 implementation of an abstract idea.” Hawk Tech. Sys., LLC v. Castle Retail, LLC, 60 F.4th 5 1349, 1358 (Fed. Cir. 2023) (citation omitted). 6 Here (and elsewhere), Splunk analogizes to SRI, which rejected likening a computer 7 method to one which could be performed in the human mind, because the “human mind is not 8 equipped to detect suspicious activity by using network monitors and analyzing network 9 packets as recited by the claims.” SRI, 930 F.3d at 1304. According to Splunk, a human mind 10 is likewise not equipped to “analyze raw machine data to select a parsing rule to segment that 11 data into events” (Opp. 11). But that is what the human mind is asked to do here, as Splunk 12 itself acknowledges (see, e.g., Opp. 12 (explaining “the claims describe creating events from 13 raw data based on a parsing rule, and previewing what those events look like via a graphical 14 interface, to allow for modifying events based on the user’s input at that interface”) (emphasis 15 added)). True, a human mind is not equipped to “graphically preview how those events would 16 be formed” using a graphical user interface and “build searchable events for a time-searchable 17 search engine index,” but these are the generic processes and machinery used in generic 18 computer implementation. Apple, 842 F.3d at 1241; Enfish, 822 F.3d at 1337–39. 19 At bottom, unlike the representative claim in SRI, the representative claim here does not 20 improve the functioning of a computer by reciting a specific technique. Nor do any of the ’206 21 patent claims, for that matter. As observed by Splunk, independent claims 19, 26, and 33 22 respond to user input indicating a “preference not to use the” parsing rule that generated a 23 preview, but this does not render the focus of these claims any less abstract (Opp. 6) (emphasis 24 in original). Each still involves parsing a broader selection of data pursuant to another parsing 25 rule based on user input after previewing the application of that parsing rule on a smaller 26 selection of data (’206 patent, cols. 22:65–67; 23:1–28, 59–76; 24:1–27, 58–67; 25:1–22). 27 This order finds that the representative claim is directed to the abstract idea of previewing 1 claim’s final limitation suggests, the claim is not “directed to a specific implementation of a 2 solution to a problem in the software arts.” Enfish, 822 F.3d at 1339. Humans have been 3 previewing data analysis rules on test samples for time immemorial. The associated 4 organizing, displaying, and manipulating of data are all directed to this abstract idea. See 5 Capital One, 850 F.3d at 1340–41. 6 Turning to Alice step two, alleged infringers argue that the representative claim fails to 7 recite a saving inventive concept because it merely recites abstract information and mental 8 steps processing this abstract information, which are purely functional (Br. 9). Thus, although 9 Splunk “may tout the inherent benefits of better data filtering or improved mental processes,” 10 the representative claim “doesn’t even go that far” (Br. 10). Splunk responds that its 11 allegations create a plausible factual issue regarding the inventiveness of the claims at Alice 12 step two sufficient to survive a motion to dismiss. It also points out that its claims include 13 “more implementation detail” than claims in other actions in which the Federal Circuit has 14 found a factual dispute (Opp. 13). This order finds the representative claim fails to recite a 15 saving inventive concept. 16 Splunk is correct that eligibility is ultimately a question of law that may be based on 17 underlying questions of fact. Berkheimer, 881 F.3d at 1365. And the Federal Circuit has held 18 that whether a claimed invention is “well-understood, routine, and conventional” under Alice 19 step two is “a question of fact.” Id. at 1368. But “not every [Section] 101 determination 20 contains genuine disputes over the underlying facts material to the [Section] 101 inquiry.” 21 Ibid. And conclusory allegations of factual disputes do not themselves make factual disputes. 22 Here, as explained above, “the purported improvements have not been captured in the 23 claim language.” Voip-Pal.com, Inc. v. Apple Inc., 375 F. Supp. 3d 1110, 1145 (N.D. Cal. 24 2019) (Judge Lucy H. Koh), aff’d sub nom. Voip-Pal.com, Inc. v. Twitter, Inc., 798 F. App’x 25 644 (Fed. Cir. 2020). “Nothing in the claims, understood in light of the specification, requires 26 anything other than off-the-shelf, conventional computer, network, and display technology for 27 gathering, sending, and presenting the desired information.” Elec. Power Grp., 830 F.3d 1 of whether the alleged improvements are ‘well-understood, routine, and conventional.’” Voip- 2 Pal.com, Inc. v. Apple Inc., 411 F. Supp. 3d 926, 974 (N.D. Cal. 2019) (Judge Lucy H. Koh), 3 aff’d, 828 F. App’x 717 (Fed. Cir. 2020). Moreover, the fact that there is more implementation 4 detail here has no bearing on this analysis. “Even a specification full of technical details about 5 a physical invention may nonetheless conclude with claims that claim nothing more than the 6 broad law or abstract idea underlying the claims, thus preempting all use of that law or idea.” 7 ChargePoint, Inc., 920 F.3d at 769. The elements of the representative claim of the ’206 8 patent thereby fail to add something more and transform the claimed abstract idea into a 9 patent-eligible invention. 10 The analysis of ’206 patent provides a helpful framework for assessing the other patents- 11 in-suit. The parties make substantially similar arguments about all of the representative claims: 12 Splunk asserts that they are rooted in technology in order to overcome technical problems 13 identified in the associated specifications, and alleged infringers highlight a disconnect 14 between the claim language and the specification language. Although this order will speak to 15 the specifics of the subsequent representative claims, the reader should bear in mind that these 16 patents are ineligible for essentially the same reasons. 17 C. THE ’438 AND ’443 PATENTS. 18 Next, this order turns to the ’438 and ’443 patents, which are entitled “Configuring the 19 Protocol-Based Generation of Event Streams” and “Transformation of Network Data at 20 Remote Capture Agents,” respectively. The ’438 and ’443 patents are taken up together 21 because Splunk takes them up together (Opp. 6–7; 13–17). 22 The representative claims of the ’438 and ’443 patents disclose methods implemented in 23 a distributed arrangement involving at least one configuration server and one remote capture 24 agent (“RCA”). Reductively, a configuration server (computer) sends configuration data 25 (instructions) to an RCA (computer) to generate time-stamped events from monitored network 26 packets. Stripped of excess verbiage, the ’438 patent discloses a method that enables an RCA 27 to “generate [an] event [data] stream based on the network traffic monitored . . . according to 1 44; see generally id. at col. 24:26–46). The configuration server “receiv[es] input” that 2 “indicat[es] a protocol to be associated with the event stream” and “an event attribute 3 associated with the protocol,” and it sends configuration data to the RCA based on this input 4 (id. at col. 24:29, 32–33, 36–37, 40–42). Note RCAs “can be physical hardware servers or 5 virtual machines running in the cloud” and “capture network data originating from numerous 6 distributed network servers” (id. at cols. 4:65–67; 5:1–2). The ’443 patent, on the other hand, 7 discloses a method for an RCA to “generat[e], based on [] configuration information, time- 8 stamped event data from at least one network packet of [a] plurality of network packets,” 9 “transforming” the time-stamped event data by “performing an operation” on it (’443 patent, 10 col. 26:38–40, 45–49; see generally id. at col. 26:27–49). 11 Per Alice step one, alleged infringers argue that Splunk has engaged in “broad, functional 12 claiming,” “the hallmark of abstractness” (Reply Br. 4 (citing Voip-Pal.com, 375 F. Supp. 3d 13 at 1133)). With regard to the representative claim of the ’438 patent, they emphasize that the 14 specification acknowledges the prior art included network elements that could monitor, 15 capture, and transform data, thereby indicating the purported improvement is to configure the 16 network elements in a centralized manner over a distributed network (Br. 15). Alleged 17 infringers aver that courts routinely find claims for distributed computing, including 18 coordination to break up tasks across multiple computers, directed to abstract ideas and 19 ineligible (Br. 15–16). As for the representative claim of the ’443 patent, alleged infringers 20 point out that it merely recites (functional) steps of “monitoring,” “segmenting” and 21 “transforming” network data, without reciting steps for processing network traffic any 22 differently than conventional network capture devices beyond, again, incorporating distributed 23 computing (Br. 11–12). 24 Meanwhile, according to Splunk, both patents “claim specific techniques for using 25 configurable ‘remote capture agents’” and address problems arising from “challenges with 26 conventional network capture and analysis technologies” that were “‘fixed,’ ‘built . . . to serve 27 a specific purpose,’ and unamenable to reconfiguration (among other problems)” (Opp. 14 1 the claims “do not automate a conventional idea, but instead claim techniques to solve 2 problems with the conventional, inflexible approach to capturing and analyzing network data” 3 (Opp. 14). According to Splunk, alleged infringers oversimplify the claims and “ignore 4 specific requirements of the independent claims, including regarding the data that must be 5 provided to the server to accomplish configuration of the related remote capture agent” (Opp. 6 15 (citing ’438 patent, col. 24:32–39)). 7 This order finds the representative claims merely invoke generic processes and 8 machinery, and that they are directed to results that are, in essence, abstract ideas. See Apple, 9 842 F.3d at 1241. “Here, the claims themselves do not disclose performing any ‘special data 10 conversion’ or otherwise describe how the alleged goal” — “fixing the conventional, inflexible 11 approach to capturing and analyzing network data” (Opp. 14) — “is achieved.” Hawk Tech. 12 Sys., 60 F.4th at 1357. As observed by alleged infringers, for both patents, “neither the claims 13 nor the specifications provide guidance on how the RCA monitors the network packets, how it 14 obtains the configuration information remotely, how the server generates configuration 15 information that the RCA can use remotely to generate timestamped event data from the 16 network packets, and how the RCA performs operations on the event data to transform it” 17 (Reply Br. 4) (emphasis in original). In other words, neither the claim language nor the 18 specification language provides guidance on how the claims achieve their functional results. 19 The Federal Circuit has repeatedly found claims that did “not sufficiently describe how to 20 achieve these results in a non-abstract way” to be directed to abstract ideas. Two-Way Media, 21 874 F.3d at 1337 (citing Affinity Labs of Tex., LLC v. DIRECTV, LLC, 838 F.3d 1253, 1258–59 22 (Fed. Cir. 2016); Elec. Power Grp., 830 F.3d at 1351)). 23 The representative claim of the ’438 patent is directed to the abstract idea of generating 24 (event) data by applying (configuration) data it receives to (network) data it monitors. The 25 representative claim of the ’443 patent is directed to the abstract idea of monitoring (network) 26 data and applying (configuration) data received to generate and transform (event) data. Note 27 claim 7 of the ’443 patent is “substantially similar and linked to the same abstract idea” as 1 “application” that “access[es] the transformed event data” does not render the abstract idea any 2 less abstract; (network) data are still monitored, (configuration) data are still received, and 3 (event) data are still generated and transformed.1 Moreover, that the methods call for an RCA 4 does not render the focus of the representative claims any less abstract (see ’438 patent, col. 5 24:27, 41–45; ’443 patent, col. 26:29). As noted by alleged infringers, Splunk’s patents 6 acknowledge “conventional” capture devices already processed network packet data into 7 separate events (Reply Br. 6 (citing, e.g., ‘438 patent, cols. 1:41–67, 2:1–19)). Whereas the 8 representative claims in SRI were directed to more than an abstract idea and “over[ode] [a] 9 routine and conventional sequence of events,” the representative claims here “merely require[] 10 a ‘computer network operating in its normal, expected manner.’” SRI, 930 F.3d 1295, 1304 11 (Fed. Cir. 2019) (quoting DDR Holdings, LLC v. Hotels.com, L.P., 773 F.3d 1245, 1258 (Fed. 12 Cir. 2014)). Unlike the representative claims in SRI and DDR, the representative claims here 13 do not offer specific technical solutions to specific technical problems identified in the 14 specifications. 15 Turning to Alice step two, Splunk argues that the specifications indicate the components 16 are not generic and, even if they were, “useful improvements to computer networks are 17 patentable regardless of whether the network is comprised of standard computing equipment” 18 (Opp. 16 (quoting Kollective, 50 F.4th at 135)). Moreover, according to Splunk, it is “entitled 19 to the plausible inference of an inventive concept from the allegations in its Complaint 20 regarding the existence of technological problems in the prior art and the solutions the claims 21 offer to address those problems” (Opp. 16–17). This order agrees with alleged infringers, 22 however, that unlike the claims disclosing particular enhancements to computer technology the 23 Federal Circuit has found eligible at step two, the representative claims here merely apply 24 result-oriented, abstract ideas without specifying any non-conventional way to accomplish or 25 practice them (Reply Br. 8). Again, the eligibility of the representative claims does not turn on 26

27 1 Splunk only discusses other independent claims in the ’438 and ’443 patents in conjunction with 1 the factual issue of whether the alleged improvements are well-understood, routine, and 2 conventional because no alleged improvement is captured in the claim language. Again, 3 “[n]othing in the claims, understood in light of the specification, requires anything other than 4 off-the-shelf, conventional computer, network, and display technology for gathering, sending, 5 and presenting the desired information.” Elec. Power Grp., 830 F.3d at 1355. As such, the 6 elements of the representative claims of the ’438 and ’443 patents fail to add something more 7 and transform the claimed abstract ideas into patent-eligible inventions. 8 D. THE ’312 PATENT. 9 This order now considers the ’312 patent, entitled “Time Stamp Creation for Event 10 Data.” The representative claim discloses a method for “creating a set of searchable events by 11 segmenting raw time series machine data from at least one data source” (’312 patent, 12 col. 17:11–13; see generally id. at col. 17:9–48). According to the specification, 13 “[s]egmentation rules describe how to divide event data into segments” (id. at col. 10:59–60). 14 In order to create a set of searchable events, the claimed method calls for “detecting whether 15 time information is present in the raw time series machine data” (id. at col. 17:23–24). It 16 provides two paths for creating events based on whether time information is present or not: 17 • If “time information is present in the event,” it is “extract[ed]” and used to “determin[e] a time zone”; the 18 time zone is used “generat[e] an offset,” thereby “normalizing the extracted time information”; and a “time- 19 stamp based on the offset” is “associated with the event.”

20 • If “time information is not present in the event,” a time stamp is “calculated” by “using one or more stored time 21 stamps . . . from one or more earlier processed events selected on a periodic basis in order to facilitate time stamp 22 creation”; and a “time stamp is “associate[ed] with the event.” 23 (id. at col. 17:26–46). The associating of time stamps “enabl[es] the events to be searched” (id. 24 at col. 17:35, 45). The final limitation is that “the method is performed by one or more 25 computing devices” (id. at col. 17:47–48). 26 27 1 Per Alice step one, alleged infringers argue that the representative claim cites a patent- 2 ineligible mental process. According to alleged infringers, this mental process is analogous to 3 that of an assistant 4 who receives a collection of pages reflecting meeting minutes, and separates (“segments”) those pages into individual reports, one 5 report for each meeting. The assistant then reorganizes the reports chronologically, using the time and date written at the top of each 6 report. The assistant can take into account the geographic location of a meeting, adjusting the meeting’s time and date based on its 7 time zone. If a report lacks time or date information, the assistant can assign a time and date “based on its context,” using other 8 information in the report, such as the meeting attendees, meeting location, and topics discussed. 9 (Br. 18). That this mental process is untethered from a technical environment is purportedly 10 demonstrated by the failure to incorporate any computer or computing components until the 11 final limitation (ibid.). Further, according to alleged infringers, the functional language is 12 unbounded, with no technical details explaining how the steps are to be accomplished. And 13 alleged infringers emphasize that any benefits arising from the claimed invention flow not 14 from improved technology but from performing an abstract idea in conjunction with well- 15 known computer technology and functional components (Br. 19). Meanwhile, Splunk once 16 more emphasizes that the patent claims are necessarily rooted in technology rather than a 17 mental process. According to Splunk, the attempt to analogize to an assistant is inapt because 18 humans cannot “segment raw time series machine data received from at least one data source 19 in an information technology environment into searchable events,” “perform the claimed 20 timestamping techniques on each event,” and “thereby enable time-based searches across an 21 index of events created from the raw data” (Opp. 18 (internal quotations and citations 22 omitted)). Moreover, the claims “recite sufficient implementation detail to perform the 23 claimed steps in a non-abstract way,” with the specification “provid[ing] even more 24 implementation detail” (Opp. 19). 25 Like the preceding representative claims, the representative claim of the ’312 patent does 26 not disclose a technologically rooted improvement but rather another generic computer 27 implementation “wherein the method is performed by one or more computing devices.” Note 1 the representative claim does not disclose how to “calculat[e] a time stamp for [an] event using 2 one or more stored time stamps,” which are “selected on a periodic basis in order to facilitate 3 time stamp creation,” when time information is unavailable (’312 patent, col. 17: 39–43). It 4 “merely carr[ies] out a longstanding commercial practice with the benefit of a computer” and 5 “manipulates data but fails to do so in a non-abstract way.” Alice, 573 U.S. at 219; Two-Way 6 Media, 874 F.3d at 1338. This order finds the assistant analogy is appropriate. The 7 representative claim is directed to the abstract idea of creating time-searchable output by 8 determining whether time information is available in a given input, and using time information 9 from earlier inputs as a proxy if time information is unavailable. Splunk underscores that this 10 input could “include unstructured data” per claims 6, 10, and 14 (Opp. 18). But adjusting the 11 given input to encompass different data does not render the claimed idea any less abstract. Cf. 12 BSG Tech LLC v. BuySeasons, Inc., 899 F.3d 1281, 1288 (Fed. Cir. 2018) (“[A]n improvement 13 to the information stored by a database is not equivalent to an improvement in the database’s 14 functionality.”). 15 Turning to Alice step two, again, the representative claim and the alleged improvement 16 discussed in the complaint and specification are misaligned. Voip-Pal.com, 375 F. Supp. 3d 17 at 1145; Elec. Power Grp., 830 F.3d at 1355. The representative claim simply does not capture 18 how to “improv[e] machine data analysis” given “problems with the way conventional 19 computer search engines handled analysis and indexing of raw time series machine data” 20 (Opp. 17). Not only are the claim language and specification language misaligned here, but 21 they also appear to be mismatched. Although the representative claim (and each independent 22 claim) discloses using a stored time stamp “from one or more earlier processed events” if time 23 information is not available, the specification discusses an implementation in which “further 24 earlier and/or later events can be used for interpolation” (compare ’312 patent, col. 17:41–41, 25 and id. at cols. 18:37–38, 20:1–2, with id. at col. 9:37–40). Meanwhile, in isolation, the use of 26 generic computer components in conventional ways do not provide an inventive concept. The 27 elements of the representative claim of the ’312 patent thereby fail to transform the claimed 1 A. THE ’467 PATENT. 2 Finally, this order turns to the ’467 patent, entitled “Dynamically Instantiating Dual- 3 Queue Systems.” The representative claim discloses a method for implementing a “multi- 4 tenant dual-queue system” that “receiv[es] . . . live data” and “rout[es] the live data to [a] dual- 5 queue node” if, “based on determining that [the node] . . . is uninstantiated,” the node is 6 “dynamically instantiat[ed]” (’467 patent, col. 24:33, 35–37, 43; see generally id. at col. 7 24:31–43). “[D]ynamically instantiating” initializes “a live data queue and a stale data queue” 8 (id. at col. 24:36, 38–39). The “initialized live data queue is enabled to receive the live data for 9 processing,” whereas “the initialized stale data queue is enabled to store a persistent backup of 10 the live data” (id. at col. 24:39–43). According to the specification, whereas “a single tenant 11 dual-queue system may include one or more servers . . . that have resources continuously or 12 permanently dedicated to incoming or outgoing data of a single customer,” “multi-tenant dual- 13 queue systems may include one or more servers . . . that have resources temporarily, 14 ephemerally, or transiently allocated to incoming or outgoing data of each of a plurality of 15 customers on an as-needed or in an on-demand basis” (id. at cols. 2:67, 3:1–8). Servers “may 16 be general or special-purpose computers” (id. at col. 4:27–28). 17 Per Alice step one, alleged infringers assert that the representative claim is directed to the 18 long-prevalent practice of handling overflow traffic on demand, and that “it recites mere 19 functions and results unlimited by particular structures or acts for how to perform or achieve 20 them” (Br. 22). According to alleged infringers, the representative claim remarkably provides 21 no technical details as to how the otherwise conventional dual-queue node is “dynamically” 22 instantiated (ibid.; Reply Br. 12). “Setting up storage of incoming data in a secondary location 23 for later transmission simply implements generic computer functionality of receiving and 24 storing data,” which then “fails as an inventive concept” at Alice step two (Br. 22). Splunk 25 responds that its claims are directed to a specific improvement in the software arts, not an 26 abstract idea (Opp. 21). Although Splunk’s complaint expressly describes the improvement as 27 addressing situations where “streams of live data [] can be generated faster than they can be 1 8:47–59), Splunk’s opposition describes it as “instead directed to specific techniques for 2 instantiating dual-queue ‘nodes’ in a ‘multi-tenant’ environment that improves on conventional 3 software practice” (Opp. 21) (emphasis in original). 4 Even though this language is rife with what are arguably this order’s most technical 5 terms, beneath the surface is arguably this order’s most abstract idea. The representative claim 6 here is directed to handling overflow data on demand. No “particular technique for 7 dynamically instantiating dual-queue nodes” is disclosed (Opp. 22). Again, the claim is result- 8 oriented: there are no details as to how the dual-queue node is “dynamically” instantiated, how 9 the live data queue is “enabled” to receive “live data for processing,” or how the stale data 10 queue is “enabled” to store a “persistent backup of the live data” (’467 patent, col. 24:36–37, 11 40, 42); Apple, 842 F.3d at 1241. Moreover, the dependent claims referenced in Splunk’s 12 opposition do not have any bearing on this determination. Some involve dual-queue nodes 13 “assigned to [a] customer” (see, e.g., ’467 patent, col. 24:49). Others involve dual-queue 14 nodes assigned to “an Internet of Things device” (see, e.g., id. at col. 24:63). But in any event, 15 the claims are still directed to the abstract idea of handling overflow data on demand (now, for 16 that customer or that device). “[L]imiting the claims to a particular technological environment 17 . . . renders them no less abstract.” People.ai, Inc. v. SetSail Techs., Inc., 575 F. Supp. 3d 18 1193, 1200 (N.D. Cal. 2021) (citing Capital One, 850 F.3d at 1340). 19 Yet again, the inventive concept remains elusive. This order agrees with alleged 20 infringers that Splunk appears to be doing some strategic recasting of purported improvement 21 in its opposition (see Reply Br. 11–12). In any event, the representative claim does not 22 disclose an inventive solution to the problem identified in the specification and Splunk’s 23 complaint — that of avoiding lost data when incoming live data arrives too quickly — beyond 24 standard caching and storing (Reply Br. 13). Nothing in it addresses increasing the amount of 25 live data that is received or other analogous improvements that could supply an inventive 26 concept. The representative claim only recites generic computer processes and machinery, and 27 a generic arrangement. Bascom, 827 F.3d 1341, 1349–50 (Fed. Cir. 2016). 1 In sum, all of the representative claims of the patents-in-suit are directed to abstract ideas 2 and lack saving inventive concepts. As such, all of the patents-in-suit run afoul of Section 101 3 and do not qualify as patent eligible. The motion to dismiss as to Splunk’s patent infringement 4 claims against Cribl is GRANTED. 5 3. INDIRECT COPYRIGHT INFRINGEMENT. 6 Turning to copyright law, alleged infringers argue that Splunk’s indirect copyright 7 infringement claims against them should be dismissed because Splunk does not adequately 8 allege that Cribl and CEO Sharp had the knowledge and intent required for contributory 9 infringement.2 According to accused infringers, Splunk makes no allegations regarding Cribl’s 10 knowledge and baldly alleges that CEO Sharp acted “with knowledge” and “intentionally” 11 (Br. 24 (citing Compl. ¶¶ 267, 271)). Splunk counters that it expressly alleges both accused 12 infringers materially contributed to or induced copyright infringement, such as when they 13 facilitated the copying, distribution, and creation of derivatives of Splunk’s code with each 14 new version of Cribl’s software (Opp. 24 (citing Compl. ¶¶ 267 –70)). According to Splunk, it 15 has also alleged the requisite intent: 16 [F]or example: “Mr. Sharp copied Splunk’s copyrighted source code for S2s [and] created a derivative of that code (go-S2S)” 17 ([Compl.] ¶ 266), with “the intention of using it for his own personal financial gain at a different company,” i.e., Cribl (id. 18 ¶ 36); [Mr.] Sharp provided this code to Cribl for its use within Stream, and, to this day, has encouraged and induced Cribl’s use of 19 this code”; “go-S2S, and/or other source code copied or derived from Splunk’s Splunk Enterprise source code, is currently used 20 within Stream and has been used within Stream since its release” (id. ¶ 40); and [alleged infringers] “sought to capitalize on their 21 access to the S2S version 3 protocol” (id. ¶ 38). This supports a plausible inference that [alleged infringers] had knowledge of, and 22 intended, each other’s infringement. 23 (Opp. 24–25). Here, this order agrees with Splunk that it has plausibly pleaded contributory 24 infringement. 25 2 Specifically, alleged infringers assert “Splunk does not adequately allege that Cribl or CEO 26 Sharp had the knowledge or intent required to plead contributory or induced copyright infringement,” but as explained below, in copyright law (unlike in patent law), induced 27 infringement is housed within contributory infringement. Note that although alleged infringers 1 Contributory copyright infringement is a “a form of secondary liability with roots in the 2 tort-law concepts of enterprise liability and imputed intent . . . . [O]ne contributorily infringes 3 when he (1) has knowledge of another’s infringement and (2) either (a) materially contributes 4 to or (b) induces that infringement.” Perfect 10, Inc. v. Giganews, Inc., 847 F.3d 657, 670 (9th 5 Cir. 2017) (quoting Perfect 10, Inc. v. Visa Int’l Serv., Ass’n, 494 F.3d 788, 794–95 (9th Cir. 6 2007)). Because Splunk brings contributory infringement claims against both CEO Sharp and 7 Cribl, this order must consider whether, on the face of the complaint, (1) CEO Sharp had 8 knowledge of others’ copyright infringement and materially contributed to or induced it; and 9 (2) Cribl had knowledge of others’ copyright infringement and materially contributed to or 10 induced it. 11 Accepting all factual allegations in the complaint as true and construing the pleadings in 12 the light most favorable to Splunk, it seems CEO Sharp had knowledge of others’ infringement 13 because, inter alia, he “derived go-S2S from Splunk’s copyrighted source code,” “provided 14 this code to Cribl . . . with knowledge that go-S2S was an unlicensed derivative of Splunk’s 15 copyrighted S2S version 3 code,” and “each new version of Cribl’s Stream software includes a 16 new copy of this unlicensed derivative of Splunk’s copyrighted S2S version 3 code” (Compl. 17 ¶¶ 36, 40–41). Similarly, accepting all factual allegations in the complaint as true and 18 construing the pleadings in the light most favorable to Splunk, it seems CEO Sharp materially 19 contributed to or induced (1) Cribl’s infringement because “Sharp provided this code to Cribl 20 for its use within Stream, and, to this day, has encouraged and induced Cribl’s use of this 21 code”; and (2) Cribl customers’ infringement because “go-S2S, and/or other source code 22 copied or derived from Splunk’s Splunk Enterprise source code, is currently used within 23 Stream and has been used within Stream since its release” (Compl. ¶ 40). A corporate officer 24 is personally liable for all torts he authorizes or directs or in which he participates 25 (notwithstanding that he acted as an agent of the corporation and not on his own behalf). 26 Coastal Abstract Serv., Inc. v. First Am. Title Ins. Co., 173 F.3d 725, 734 (9th Cir. 1999). 27 Turning to Cribl’s alleged contributory infringement, accepting all factual allegations in 1 complaint clearly provides for the possibility that CEO Sharp’s knowledge could be attributed 2 to Cribl as well. According to Splunk’s complaint, “Mr. Sharp and Cribl sought to capitalize 3 on their access to the S2S version 3 protocol” (Compl. ¶ 38). Similarly, the complaint contains 4 language that could support Cribl’s material contribution to or inducement of others’ copyright 5 infringement (see, e.g., Compl. ¶¶ 47, 40 (alleging “Cribl has used its illicitly obtained support 6 for the S2S version 3 protocol as a means to convince Splunk’s customers to buy software and 7 services from Cribl” and “go-S2S, and/or other source code copied or derived from Splunk’s 8 Splunk Enterprise source code, is currently used within Stream and has been used within 9 Stream since its release”)). As such, CEO Sharp may have acted as an agent of Cribl at the 10 time he knew of customers’ infringement and materially contributed to or induced it. Of 11 course, it may be that CEO Sharp’s co-founders had no idea that Cribl’s source code was 12 derived from go-S2S or that go-S2S was derived from Splunk’s copyrighted code. And it may 13 be that go-S2S is not even a derivative of Splunk’s copyrighted code. But Splunk’s allegations 14 are sufficient to survive a motion to dismiss. 15 Because Splunk has plausibly pleaded contributory copyright infringement against CEO 16 Sharp and Cribl, the motion to dismiss as to Splunk’s contributory copyright claims is DENIED. 17 4. VIOLATION OF DIGITAL MILLENNIUM COPYRIGHT ACT SECTION 1202. 18 Lastly, this order considers whether Splunk’s claim for violation of Digital Millennium 19 Copyright Act (“DMCA”) Section 1202 against CEO Sharp should be dismissed. According 20 to Cribl, this dismissal is warranted for two reasons: (1) Splunk has failed to plead copyright 21 management information (“CMI”) with the specificity that courts in this district have required, 22 and (2) Splunk has failed to plead the required scienter for a violation of Section 1202 (Br. 24– 23 25). Splunk counters that it has pleaded CMI and scienter with sufficient specificity. Again, 24 this order agrees with Splunk. 25 Section 1202(a) prohibits knowingly and intentionally inducing, enabling, facilitating or 26 concealing copyright infringement by (1) providing false CMI and (2) distributing or importing 27 for distribution false CMI. 17 U.S.C. § 1202(a)(1)–(2). Section 1202(b) prohibits 1 distribution CMI that has been removed or altered, and (3) knowingly distributing, importing 2 for distribution, or publicly performing works or copies of works whose CMI has been 3 removed or altered. Id. § 1202(b)(1)–(3). Splunk alleges that CEO Sharp violated both 4 provisions (Compl. ¶¶ 291–92). The relevant claim language provides, in pertinent part: 5 As described above, Clint Sharp created the go-S2S source code by copying copyrighted Splunk source code, which contained Splunk 6 copyright headers indicating authorship and ownership information reflecting Splunk’s copyright in this code. Mr. Sharp’s derivative 7 go-S2S code, however, did not include headers indicating Splunk’s authorship and ownership of the copyright in the go-S2S code; Mr. 8 Sharp therefore provided false CMI and intentionally removed or altered CMI in creating the go-S2S code, without the authority of 9 Splunk.

10 Mr. Sharp distributed code containing false, removed, and altered CMI for the entire duration of time that he maintained the go-S2S 11 source code repository online, and at least until December 2021. Any time Mr. Sharp’s go-S2S source code repository was 12 accessed, Mr. Sharp distributed code containing this false, removed, and altered CMI. 13 Mr. Sharp also provided and distributed code containing false CMI 14 by uploading an open-source MIT license to the go-S2S github repository, falsely identifying Mr. Sharp as the author and/or 15 owner of the copyright in the go-S2S code, and falsely providing open-source terms for use of the go-S2S code, despite its 16 derivation from Splunk’s source code.

17 Mr. Sharp distributed code containing this false CMI from December 2018 at least until December 2021. Any time Mr. 18 Sharp’s go-S2S source code repository was accessed, Mr. Sharp distributed code containing this false, removed, and altered CMI. 19 (Compl. ¶¶ 294–97). These facts are also set out in the complaint’s “General Allegations” 20 (Compl. ¶¶ 37, 42–44). 21 Starting with specificity of pleading CMI, this order agrees with Splunk that it adequately 22 described the CMI at issue and that alleged infringers cite cases that do not suggest more is 23 required (Opp. 25). Whereas in Free Speech Systems, LLC v. Menzel, 390 F. Supp. 3d 1162, 24 1175 (N.D. Cal. 2019) (Judge William H. Orrick), the copyright owner failed to provide “any 25 facts to identify which photographs had CMI removed or to describe what the removed or 26 altered CMI was,” there is no question here that, as alleged, the CMI was removed from the 27 go-S2S code and the CMI was code that “indicat[ed] authorship and ownership information 1 reflecting Splunk’s copyright” (Compl. ¶ 294). Whereas in SellPoolSuppliesOnline.com, LLC 2 v. Ugly Pools Arizona, Inc., 804 F. App’x 668, 670–71 (9th Cir. 2020), the CMI “allegedly 3 removed by [alleged infringers] did not identify [the copyright owner] as the owner or author 4 of any content on the website,” Splunk has expressly alleged that the removed copyright 5 headers indicated authorship and ownership (Compl. ¶ 294). And whereas in Logan v. Meta 6 Platforms, Inc., 2022 WL 14813836, at *8 (N.D. Cal. Oct. 25, 2022) (Judge Charles R. 7 Breyer), the CMI was “separated from the rest of the content on the webpage,” here Splunk 8 specifically stated that the headers were removed from the go-S2S code itself (Compl. ¶ 292). 9 The Court may later determine that the CMI was not, in fact, CMI (as defined in Section 10 1203); or that the copyright headers did not, in fact, identify Splunk as an owner or author; or 11 that they were not, in fact, removed from the go-S2S code; or that the go-S2S code was not, in 12 fact, a derivative of Splunk’s copyrighted source code. For now, however, the CMI is 13 sufficiently pleaded to survive a motion to dismiss. 14 As for the argument that Splunk has failed to plead the required scienter for a violation of 15 Section 1202, that is foreclosed by the language in Splunk’s complaint. According to the 16 complaint, “[i]n or around December 2018, Mr. Sharp added an open-source MIT license to 17 the go-S2S source code on his personal [G]it[H]ub webpage, falsely identifying himself as the 18 author and/or owner of the copyright in the go-S2S code, and falsely providing open-source 19 terms for use of the go-S2S code, despite its derivation from Splunk’s proprietary source code” 20 (Compl. ¶ 42). CEO Sharp allegedly “added this false license to the go-S2S code to obscure 21 his own unlawful copying of Splunk’s copyrighted source code” (Compl. ¶ 43). Alone, this is 22 sufficient to plead a violation of Section 1202(a) (involving false CMI). 23 True, Splunk does not directly allege that CEO Sharp’s removal of the copyright headers 24 indicating authorship and ownership information was “knowing.” But the complaint states that 25 “Mr. Sharp derived go-S2S from Splunk’s copyrighted source code with the intention of using 26 it for his own personal financial gain at a different company,” that “[t]he Splunk S2S version 3 27 code that Mr. Sharp copied contained Splunk copyright headers indicating authorship and 1 “Mr. Sharp removed this information from the derived files that he posted on his personal 2 [G]it[H]ub page” (Compl. J] 36-37). Construing this in the light most favorable to Splunk, 3 that CEO Sharp removed these headers from proprietary source code and posted that source 4 code to a personal, publicly accessible webpage supports a plausible inference that he did so 5 knowingly — especially when he later added an open-source license that “falsely identif[ied] 6 [CEO Sharp] as the author and/or owner of the copyright in the go-S2S code” (Compl. { 42). 7 As such, the language in the complaint is sufficient to plead a violation of Section 1202(b) 8 Gnvolving removed or altered CMI) as well. 9 Because Splunk has plausibly pleaded a violation of DMCA Section 1202 against CEO 10 Sharp, the motion to dismiss as to that claim is DENIED. 11 CONCLUSION 12 For the foregoing reasons, the motion to dismiss is GRANTED IN PART and DENIED IN 5 13 PART. The motion is GRANTED as to all claims for willful and indirect patent infringement 14 against Cribl, as well as all claims for infringement of the five asserted patents against Cribl 3 15 based on their ineligibility. The motion is DENIED as to all claims for indirect copyright 16 infringement against Cribl and CEO Sharp, as well as the claim for violation of DMCA Section 3 17 1202 against CEO Sharp. Alleged infringers’ answer is due in FOURTEEN DAYS. 18 Splunk may move for leave to amend its complaint. Such motion must be filed within 19 FOURTEEN DAYS and include as an exhibit a redlined version of the proposed amendment that 20 clearly identifies all changes. This order highlighted certain deficiencies, but merely adding 21 sentences to address these deficiencies may not justify leave to amend. If Splunk moves for 22 leave to file an amended complaint, it should be sure to plead its best case and consider all 23 criticisms made by alleged infringers, including those not reached by this order. 24 IT IS SO ORDERED. 25 26 Dated: March 17, 2023. Pee 27 A = ILLIAM ALSUP 28 UNITED STATES DISTRICT JUDGE