Splunk Inc. v. Cribl, Inc.

Opinion

1 2 3 4 5 6 UNITED STATES DISTRICT COURT 7 NORTHERN DISTRICT OF CALIFORNIA 8

10 SPLUNK INC., 11 Plaintiff, No. C 22-07611 WHA

12 v.

ORDER RE MOTIONS TO SEAL 13 CRIBL, INC., 14 Defendant.

15 16 This order addresses all pending motions to seal and supporting declarations (Dkt. Nos. 17 190, 191, 201–04, 208, 209, 224, 230, 237, 238, 241, 242, 251, 261, 272, 280, 298, 302, 340). 18 1. THE LEGAL STANDARD. 19 There is a strong public policy in favor of openness in our court system and the public is 20 entitled to know to whom we are providing relief (or not). See Kamakana v. City & Cnty. of 21 Honolulu, 447 F.3d 1172, 1178–80 (9th Cir. 2006). Consequently, access to motions and their 22 attachments that are “more than tangentially related to the merits of a case” may be sealed only 23 upon a showing of “compelling reasons” for sealing. Ctr. for Auto Safety v. Chrysler Grp., 24 LLC, 809 F.3d 1092, 1101–02 (9th Cir.), cert. denied, 580 U.S. 815 (2016). Filings that are 25 only tangentially related to the merits may be sealed upon a lesser showing of “good cause.” 26 Id. at 1097. Evidentiary motions, like motions in limine and Daubert motions, can correlate 27 with the merits of a case. Id. at 1098–1100. Indeed, the “‘compelling reasons’ standard 1 665, 677–78 (9th Cir. 2010), cert. denied sub nom. Experian Info. Sols., Inc. v. Pintos, 562 2 U.S. 1134 (2011)). 3 Additionally, parties in this district must ensure their sealing motions meet basic 4 adequacy requirements. Above all, they must “narrowly tailor” requests “to seal only the 5 sealable material.” Civil L.R. 79-5(c). And they must list each document or passage to be 6 sealed — here each passage (Dkt. No. 141) — together with its rationale for sealing. Ibid. For 7 each listed, they must specifically state: (1) the legitimate private or public interests that 8 warrant sealing; (2) the injury that will result should sealing be denied; and (3) why a less 9 restrictive alternative to sealing is not sufficient. Civil L.R. 79-5(c). They must provide 10 evidentiary support where necessary, such as by sworn declaration. Ibid. And, for pleadings, 11 parties must file both redacted and unredacted copies (or ensure another party does), and 12 include in the unredacted copies highlighting to show proposed redactions. Id. at (d)–(e). 13 Failure to follow the rules suggests a lack of cause or interest to seal, and risks summary denial 14 (Dkt. No. 141). See Civil L.R. 79-5(f)(6), (g)(2). 15 Redaction may be appropriate where publication “could result in infringement upon trade 16 secrets.” Apple Inc. v. Psystar Corp., 658 F.3d 1150, 1162 (9th Cir. 2011), cert. denied, 566 17 U.S. 986 (2012). So too where “business information” might “harm a litigant’s competitive 18 standing,” particularly where the public has “minimal interest” in that information. See 19 Nixon v. Warner Commc’ns, Inc., 435 U.S. 589, 598 (1978). And, in general, redaction will be 20 appropriate where publication would turn “court files [into] a vehicle for improper purposes,” 21 Kamakana, 447 F.3d at 1179 (quoting Nixon, 435 U.S. at 598), such as “to gratify private spite, 22 promote public scandal, [or] circulate libelous statements,” ibid. But “vague boilerplate 23 language or nebulous assertions of potential harm” will not suffice to support redaction. 24 Bronson v. Samsung Elecs. Am., Inc., 2019 WL 7810811, at *1 (N.D. Cal. May 28, 2019) 25 (citing Civil L.R. 79-5). Nor will mere “[r]eference to a stipulation or protective order that 26 allows a party to designate certain documents as confidential.” Civil L.R. 79-5(c); see also 27 Kamakana, 447 F.3d at 1180. “A party seeking to seal a judicial record [ultimately] bears the 1 1178. The final determination is “left to the sound discretion of the trial court.” Ctr. for Auto 2 Safety, 809 F.3d at 1097 (quoting Nixon, 435 U.S. at 599). 3 Here, parties were reminded that “[n]oncompliant submissions are liable to be stricken in 4 their entirety” (Dkt. No. 69 ¶ 5). Then reminded again (Dkt. No. 124 at 2). The Court denied 5 parties’ initial sealing requests related to Rule 12 motions and discovery-letter briefs (Dkt. 6 No. 140). Still, parties next filed nearly 3,000 pages of conditionally sealed exhibits related to 7 their summary judgment and Daubert motions (Dkt. No. 141 at 2). The filings violated basic 8 requirements (id. at 3–4). But to avoid prejudice to third parties, the Court permitted parties to 9 refile narrower requests in subsequent omnibus sealing motions (id. at 4). 10 Those omnibus sealing motions and subsequent sealing motions are at issue here, 11 organized by the substantive motions to which they relate. Because Splunk and Cribl have 12 overlapping customers, many of their requests overlap, too. Nonetheless, their requests are 13 separated within each section so any salient distinctions can be drawn. 14 2. MOTIONS TO SEAL STEMMING FROM SPLUNK’S MOTION FOR 15 SUMMARY JUDGMENT. 16 For the omnibus motions sealing motions covering this and other sections (Parts 2–7), parties 17 failed to timely refile every corrected copy, and some copies were refiled with more redactions 18 (not fewer). Such failings favor denying redactions outright (supra). But particularly to avoid 19 prejudice to third parties, this order will “trudge on.” Cf. Goesel v. Boley Int’l (H.K.) Ltd., 738 20 F.3d 831, 835 (7th Cir. 2013) (Judge Richard Posner). This order states below where such 21 failures not only weigh in the result but tip the scales. Parties had more than “a chance to 22 show ‘compelling reasons’ and,” often, they “squandered it.” Kamakana, 447 F.3d at 1181. 23 Splunk moved for partial summary judgment (Dkt. No. 131), and Cribl opposed (Dkt. 24 No. 146). Splunk’s omnibus motion to seal (Dkt. No. 190) and Cribl’s (Dkt. No. 191; see also 25 Dkt. Nos. 204, 224, 341) declare support for sealing passages. This order rules as follows: 26 27 A, SPLUNK’S MOTION FOR SUMMARY JUDGMENT ON COUNT 1 VII. 2 i Splunk’s Proposed Redactions. |Sealed | Public__|ResultRe_ [Reasoning 3 Dkt. No. Cf GRANTED- This document details an engineering spike to 4 133-17 Dkt. No. | IN-PART, reverse engineer the newest Splunk-to-Splunk (Exh. 27, 352-14 DENIED-IN-__| protocol, S2S v4, and its implementation with 5 S2S v4 PaRT. Splunk Enterprise. Redactions are warranted for Protocol the same reasons and to the same extent described 6 Findings, with respect to the same document at trial (see 7 CRIBL _ infra entry re Dkt. No. 352-14 (TX-45)). 00009624 8 (Exh. 34, Dkt. No. | Banking Disclosure of banking details invites security risks Cribl’s 131-35 details, while adding nothing to public understanding. 9 Purchase GRANTED. Order of 10 Splunk, 11 SPLUNK __ 00048567 a 12 li Cribl’s Proposed Redactions. 13 || [Sealed [Public [ResultRe | Reasoning Dkt. No. Dkt. No. 186:23, Proposed redactions target a repository where 14 133-6 131-14 GRANTED. Cribl keeps contracts. Cribl contends disclosure 2 15 (Exh. 13, would provide a target to bad actors. Because Sharum the name of this repository is also entirely A 16 Dep. Tr.) unrelated to the merits, redaction is warranted. 187:4, The balance shifts with these proposed 17 DENIED. redactions. They target a repository discussed in roe open court. And the deposition says Cribl has 18 not used it for this purpose for four years. 19 (See previous entry.) DENIED. 20 (See supra entry re Dkt. Nos. 133-6 at 186:23.) GRANTED. “ene GRANTED. (See id. at 187:4.) 23 DENIED. (See id. at 186:23.) 24 GRANTED. (See id. at 187:4.) 25 DENIED. 6 (See id. at 186:23.) GRANTED. 27 This engineering ticket describes one of Cribl’s 3g 133-13 131-24 DENIED. efforts related to the S2S protocol. The

(Exh. 23, (slip- document was submitted as an unredacted trial 1 CRIBL_ sheet) exhibit (Dkt. No. 352-12). 2 00000139) Dkt. No. Dkt. No. 343:4, The customer name proposed for redaction was 3 133-23 131-37 DENIED. disclosed in open court and in a court order (see, (Exh. 3, (slip- e.g., Dkt. No. 373 at 8). There is no reason to 4 Expert sheet); cf. redact this instance. Mattmann Dkt. No. 5 Dep. Tr.) 189-54 6 Dkt. No. Dkt. No. Customer This sales slide contains a box for “Customers / 133-28 131-44 names in 10 Prospects,” followed by a couple names. Cribl 7 (Exh. 43, (slip- [ECF p. 13], seeks redactions to protect its customers’ CRIBL_ sheet) DENIED. “identity” and “information” and itself (Dkt. No. 8 00857552) 224-1 at 12). But Cribl did not submit redactions to show what information it considered the 9 customers’, relying instead on a slip-sheet (see 10 id. (citing Dkt. No. 131-44)). That went contrary to the Court’s caution (Dkt. No. 124). And no 11 plausible harm will come from disclosure. Customer (See previous entry.) 12 names in 13 11–14 [ECF pp. 14–17], 14 DENIED. Partnership (See ibid.) 15 information in 21 16 [ECF p. 18], 17 DENIED. Dollar and Here, Cribl points to specific words to make 18 percent clear what it proposes to redact: two-year-old, amounts after average sales targets related to the dispute but 19 “ADS” not clearly related to any of Cribl’s current [ECF p. 24], partnership goals or pricing. Any harm from 20 DENIED. releasing this information is speculative. 21 Dkt. No. Dkt. No. Customer Listed here are the names of service providers 133-29 131-45 names after with whom Cribl partners to go to market (Dkt. 22 (Exh. 44, (slip- “Key No. 133-29 at -353). Cribl states their “identity” CRIBL_ sheet) Partners” in is “confidential” (Dkt. No. 224-1 at 12). But 23 00856351) -353, Cribl’s website touts several of the partnerships. 24 DENIED. And the document was admitted as an unredacted exhibit at trial (Dkt. No. 352-52). 25 Before (See previous entry.) “accounts to 26 collaborate on” in -353, 27 DENIED. B. CRIBL’S OPPOSITION TO SPLUNK’S MOTION FOR SUMMARY 1 JUDGMENT ON Count VII. 2 i Splunk’s Proposed Redactions. Sealed | Public__|ResultRe_ [Reasoning 3 Dkt. No. Dkt. No. | Customer The report discusses instances when Cribl 4 147-1 149-1 names in performed work, and whether that work merely (Exh. 1, 477, solved Cribl-Splunk interoperability problems or 5 Excerpts DENIED. did something more. Proposed redactions target of Expert several customer names. Related software 6 Mattmann development tickets showing all but one name 7 [Reb.] were admitted at trial (Dkt. Nos. 352-27, 352-6). Rpt. Splunk’s rationale is unconvincing. 8 Dkt. No. Dkt. No. | Customer The deposition describes the needs and savings of 147-4 149-13 names in Splunk customers when using Cribl. Some 9 (Exh. 13, 4:3, 4:9; customer names are included, alongside specific Excerpts of 246:6-7, usage and expenditure information (or citations to 10 Strong 246:23-24; documents with the same). The names do not 11 Dep. Tr.) 247:2, meaningfully tie in with other testimony. Thus, in 247-15, this context, disclosure presents risks to the third a 12 247:25; parties (and to Cribl, infra) but no benefit to 248:6-7; public understanding. 13 249:9-11, 4 GRANTED. Dkt. No. Dkt. No. | Customer Customer names in 3:4—7, 367:13 B45 147-5 149-17 names and Redaction is warranted to avoid re-associating (Exh. 17, financial financial information with third parties, a concern 16 Excerpts of figures in Cnibl better articulates for this passage (infra). L. 3:4-7; This concern applies even though more general = 17 Bitincka 351:12; discussion of one third party occurred in court; 3 18 Dep. Tr.) 367:13-22, these further details are beyond what is needed to GRANTED- understand the case. 19 IN-PART, GRANTED. DENIED-IN- 20 PART. Otherwise Other proposed redactions target a single 21 customer name without adjacent details, or of financial figures that — once the names above are redacted — cannot be readily tied to specific 23 customers or needs, thus undercutting the rationale for their redaction. DENIED. 24 Dkt. No. Dkt. No. | Customer The passage discusses just one Splunk customer, 147-6 149-20 name in and how that customer long ago used Crib] to 25 (Exh. 20, 148:6-10; save. Splunk seeks to redact “customer lists” and Excerpts of 149:1; “targets,” not pricing. Cribl seeks to redact for Dalpe Dep. 150:21, broader reasons (infra). Neither specifies how Tr.) DENIED. disclosing what this customer stopped paying ears ago will cause harm today. 28

ii Cribl’s Proposed Redactions. 1 || [Sealed | Public _[ResultRe [Reasoning > Dkt. No. Dkt. No. 977, Cribl adds nothing to change the calculus. (See 147-1 149-] DENIED. supra entry re Dkt. No. 147-1 & 149-1.) 3 (Exh. 1. Expert 4 Mattmann Reb. Rpt. | fie [ea 6 147-4 149-13 GRANTED. (Exh. 13, 246:6-7, (See ibid.) 7 Strong 246:23-24; Dep.) 247:2, 5, 15, 8 25, 9 GRANTED. 248:6-7, (See ibid.) comm, 11 GRANTED. 17s 149-17 | GRanrep. L. Bitincka DENIED. ibid.).

GRANTED. 367:22, 16 DENIED. 17 Dkt. No. Dkt.No. | Highlights in | (See supra entry re Dkt. Nos. 147-6 & 149-20.) 147-6 149-20 148:6, 8, 9; 4 18 | | Exh. 20, 149:1: a Ee 19 Dep. DENIED. 147-7 149-21 8:12-8:13, risk annoyance and abuse for a third party but 21 (Exh. 21, GRANTED. not aid public understanding of the case. D. Bitincka 22 Dep. 23 3. MOTIONS TO SEAL STEMMING FROM CRIBL’S MOTION FOR 24 SUMMARY JUDGMENT. 25 Crib] also moved for partial summary judgment (Dkt. No. 132). Splunk opposed (Dkt. 26 No. 151). And Cribl replied (Dkt. No. 176). Parties’ omnibus motions again declare support 27 for sealing passages. 28

A. CRIBL’S MOTION FOR SUMMARY JUDGMENT. 1 2 Recall that Cribl sought summary judgment on several counts (Dkt. No. 189-1). One was 3 Splunk’s allegation that Cribl’s access to Splunk Enterprise violated the Digital Millenium 4 Copyright Act’s anticircumvention provisions (id. at 11–14 (citing 17 U.S.C. § 1201(a))). 5 Cribl argued that Splunk had not controlled access to Splunk Enterprise (ibid.). A supporting 6 argument briefed there (id. at 12–13), in the lead-up to trial (e.g., Dkt. No. 197 at 18), and in a 7 motion for judgment as a matter of law (e.g., Dkt. No. 290 at 1–4 & n.1), among other places, 8 was whether Splunk controlled the phrase that a Splunk forwarder uses to interoperate with a 9 Splunk indexer (e.g., Dkt. Nos. 200 & 201-1 at 351–54 & nn.3–4). With the backwards- 10 compatible phrase even appearing on Splunk’s own website, Splunk chose to emphasize other 11 points at trial (see Dkt. No. 290 at 2 n.1; Tr. 803). Splunk lost the issue (Tr. 1528). 12 Returning to the sealing motions, many of Splunk’s proposed redactions target that 13 phrase in its varied preparations. But, if Splunk ever did control the phrase, Splunk did not 14 control it here. Splunk does not move to redact passages — in everything from a deposition to 15 a jointly proposed trial order — that disclose it. This includes passages expressly treating the 16 current protocol version. Where Splunk does propose redactions, it often proposes to redact 17 some but not all instances, even within the same paragraph. Splunk also does not propose to 18 redact the many sentences that do not name the phrase but that explain how to find it. 19 Splunk gets bolder still — and no less sporadic. Splunk proposes to redact not just 20 information about the header in its implementation of S2S v4, but the concept of a header as 21 such. Sometimes. Splunk, for example, proposes to redact the word “header” three times in 22 one paragraph of an expert report attached to a dispositive motion, but not in the report’s 23 equally generic section title just above that paragraph: “Cribl’s Use of Splunk’s S2S ‘Header 24 Signature’ (Code Phrase) Does Not Enable ‘Interoperability’” (Dkt. Nos. 148-18 & 167-19 at 25 16). Splunk seeks to redact other generic concepts in some places but not others. Those 26 include “capabilities exchanges,” “keys and values,” “event fields,” “logging,” “likely or 27 unlikely” macros, and “state machines,” all cited in or attached to dispositive motions and 1 many discussed at trial (e.g., Tr. 913-16, 970-72). If there were reasons for redacting some 2 but not all such mentions, Splunk does not say so. 3 Because these concepts related to the merits (as Splunk asserted), Splunk needed to show 4 a “compelling interest” to seal their mention. Kamakana, 447 F.3d at 1180. But Splunk’s 5 sealing motions offer only boilerplate rationales, which Splunk’s scattershot redactions then 6 blow apart. Splunk suggests, for instance, that the short header phrase might be Splunk’s 7 “techniques,” or its “source code” manifesting them; its “trade secrets,” or its “other non- 8 public information” (see, e.g., Dkt. No. 190 at 9). Whatever if is, the phrase is not something 9 Splunk’s filings and sealing motions treat with compelling interest. Same goes for the other 10 concepts. Splunk identifies “specific redactions, [but] it justifie[s] them by invoking general 11 categories of privileges without elaboration.” Kamakana, 447 F.3d at 1183. That will not do. a 12 To go against the presumption of public access, a sealing order must “articulate the factual

& 13 basis for its ruling, without relying on hypothesis or conjecture.” Jd. at 1179 (quoting

v 14 Hagestad v. Tragesser, 49 F.3d 1430, 1434 (9th Cir. 1995)). The most that can be said here is

2 15 that these redactions will impede public understanding — not commercial rivals — on points

16 basic to the dispute. Take one last example: Splunk even proposes to redact the definition =

2 17 of “S2S” (Dkt. Nos. 148-13 & 167-14 § 76; see also Dkt. No. 190 at 16). That

5 . Z 18 Splunk-to-Splunk protocol was the case’s main subject, from complaint to conclusion. Some 19 details merit maintaining under seal. But Splunk’s overbroad redactions of basic concepts must 20 be rejected, as further explained where appropriate below. 21 (i Splunk’s Proposed Redactions. || [Sealed ___| Public _| Result Re Dkt. No. Dkt. No. | Customer The passage states a customer name, and Splunk 23 134-1 189-1 name m seeks to avoid publishing “even a portion” of its (Mot.) 22:3, customer list. But this name was disclosed in 24 DENIED. court; there is no reason to redact it here. Dkt. No. Dkt. No. | Customer The same names were disclosed in the same 25 134-7 189-34 names document admitted as a trial exhibit (Dkt. No. 26 (Exh. 14, -5-8, 352-95). GOALS DENIED. 27 FOR Financial The same is true here: This document was TODAY, numbers 1 disclosed at trial (Dkt. No. 352-95). Moreover, 28 -4, the financial numbers are two-years old, high-

SPLUNK _ DENIED. level, and not the “expenditures of specific 1 00225765) customers” (see Dkt. No. 190 at 15). 2 Dkt. No. Dkt. No. Customer The deposition mentions two customers and high- 134-9 189-36 name in level needs they long ago looked to Cribl to solve. 3 (Exh. 18, 29:16; One was discussed in open court. Nothing here Excerpts of 30:6–21; merits redaction. 4 Rottenberg 31:2, Dep. Tr.) 31:18; 5 41:9; 6 53:16–19, DENIED. 7 Dkt. No. Dkt. No. Customer These customer names were disclosed in the same 134-10 189-37 names in document admitted as an exhibit at trial (see Dkt. 8 (Exh. 20, -39, No. 352-94). Mechanics -41–45, 9 for DSP -47, 10 End of DENIED. Sale, Financial These now-stale financial figures were also 11 SPLUNK_ terms at revealed at trial (see previous entry). 00225739) -39, 12 -43, 13 DENIED. Dkt. No. Dkt. No. DENIED. This customer’s name was disclosed in open 14 134-12, 189-39 court. Nothing warrants its redaction here. (Exh. 23, 15 Re: Cribl Partners, 16 SPLUNK_ 17 00301406) Dkt. No. Dkt. No. DENIED. (See previous entry.) 18 134-14 189-41 (Exh. 32, 19 Re: Info Email 20 SPLUNK 21 00266860) Dkt. No. Dkt. No. Repository Proposed redactions obscure code commit 22 134-16 189-43 identifiers in identifiers (in a large table and in-line), the (Exh. 36, 10:13–11:22; specific directory where code related to 23 Excerpts of 17:15; authentication occurs, and other details distant 24 Splunk’s 45:13; from the merits, but which could cause 7th Supp. 46:9; commercial risks to Splunk if exposed. 25 Resp. to 102:6; Cribl’s 1st 103:16, 26 Set of GRANTED. Interrogs.) Code and This protocol signature strikes a merits question 27 techniques and is disclosed elsewhere (supra discussion Part 43:12; 1 103:20, 2 DENIED. Customer 78:13-79:19 3 names in Exposing this extensive bullet-point list of 48:9–10; customer names would add little to understanding 4 74:25–75:1; but could unfairly assist rivals and harm Splunk. 5 78:13–79:19, Redaction is warranted. GRANTED. GRANTED- 6 IN-PART, Otherwise DENIED-IN- One proposed redaction is not of a customer 7 PART. name. Another is related to testimony heard in court, undercutting the rationale. DENIED. 8 Dkt. No. Dkt. No. Customer This collection of customer names meets the 134-19 189-45 names in standard for redaction. First, the number of 9 (Exh. 49, 5:14–17; customer names in close quarters here, often in 10 Excerpts of 6:17–22; table format, creates a relatively robust customer Cribl’s 7th 9:2–21; list Splunk’s rivals could readily exploit, even if 11 Supp. and 10:6–14; some names are individually exposed elsewhere. Amd. 15:2–6; Second, many of the customer names are in close 12 Resp. to 16:9–15; association with file names, pointing towards Splunk’s 17:28; other detailed information that if disclosed could 13 2nd 18:8–19; bring harm to the third parties and so to Splunk 14 Set of 19:6–14; (and Cribl, infra, as it describes more fully). Interrogs.) 24:2–6; Third, the legal subject matter here concerns 15 25:11–17; discovery as to whether any Cribl-related persons 27:4–23; possessed Splunk-related confidential 16 28:11–19; information. Customer names are less helpful to 17 31:10; understanding this issue (than to issues of nn.5, 9, contract, copyright, and fair use, which sometimes 18 GRANTED. involve when and how Cribl worked with customers). 19 Name of Splunk seeks to redact this generically named and business tool widely used type of business tool, one version of 20 at 7:2; 8:15; which it uses. Splunk says that releasing its name 21 16:22; 17:13; will harm “Splunk’s competitive standing and 25:25; 26:17, give competitors an unfair advantage in the 22 DENIED. market” (Dkt. No. 190 at 14). No. Dkt. No. Dkt. No. ¶¶ 157–62, This passage exemplifies what was described 23 135-2 189-2 164, above (Part 3.A). Much as did later open-court 24 (Exh. A, DENIED. testimony, the passage explains at a high level Excerpts of how protocols work generally, and how the 25 Expert protocol at issue works generally. Feamster In that context, Splunk proposes redacting 26 Op. Rpt.) general concepts — erratically. For instance, were Splunk to have its way, the public would be 27 told that there is a “capabilities exchange,” that not that this “[redacted] between the client and | server exchanges information.” Such redactions 2 burden public understanding. But Splunk fails to show they burden commercial rivals about 3 anything the rivals do not know already — especially as the same passage goes unredacted 4 elsewhere (e.¢., Dkt. No. 189-69 § 157). Other 5 redactions are similarly overbroad (see Part 3.A). Dkt. No. Dkt. No. | Customer Disclosing so many customer names at once could 6 135-5 189-10 names in harm Splunk by providing a rival with a list of (Exh. A, figs. 10-11; | targets, even if a few are disclosed individually 7 Excerpts of 164,171, | elsewhere. Plus, disclosure here would re- Expert GRANTED. associate customers with private financial details 8 Heinemann (concerning Cribl, infra). Redacting the names 9 Reb. Rpt.) avoids those risks while leaving important details. All else in The proposed redactions are of two charts 10 figs. 10-11, | showing particular customers’ spending over time DENIED. with Splunk, before and after using Cribl. Some 11 numbers from these charts were later shared in court. Splunk contends the redacted charts 12 disclose pricing important to its business. But S 23 Splunk does not provide a reason to redact the two charts just below (figs. 12-13), which show 14 average spending per customer. And, once the customer names are redacted here such that their 2 15 spending cannot be easily associated with their 16 requirements, Splunk’s supposed harms about revealing pricing become even more speculative. DENIED. neither Splunk nor Cribl below provides a Z 418 rationale. 19 ii, Cribl’s Proposed Redactions. |Sealed | Public __| ResultRe __| Reasoning 20 Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 134-1 & 189-1.) 1 134-1 189-1 name in (Mot.) 22:3, 27 DENIED. Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 134-9 & 189-36.) 23 134-9 189-36 name in (Exh. 18, 29:16; 24 Rottenberg 30:6, 11; 21; 25 Dep. Tr.) 31:2, 18; 41:9, 26 DENIED. Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 134-16 & 189-43.) 27 134-16 189-43 name in 28 74:25,

(Exh. 36, DENIED. 1 Excerpts of 74:28, (See ibid.) 2 Splunk’s DENIED. 7th Supp. 75:1, (See ibid.) 3 Resp. to DENIED. Cribl’s 1st Customer (See ibid.) 4 Set of names in Interrogs.)) 78:13–79:19, 5 GRANTED. 6 Dkt. No. Dkt. No. 5:14, 5:17, (See supra entry re Dkt. Nos. 134-19 & 189-45.) 134-19 189-45 GRANTED. 7 (Exh. 49, 6:7–6:18, (See ibid.) Excerpts of 6:21, 8 Cribl’s 7th GRANTED. 9 Supp. and 9:2, 9:10, (See ibid.) Amd. 9:21, 10 Resp. to GRANTED. Splunk’s 10:14, (See ibid.) 11 2nd GRANTED. Set of 15:2, 15:5, (See ibid.) 12 Interrogs.) GRANTED. 13 p. 16 ll. 9–10, (See ibid.) 13–14, 14 GRANTED. 17:28, (See ibid.) 15 GRANTED. 16 18:8, 18:19, (See ibid.) GRANTED. 17 19:14, (See ibid.) GRANTED. 18 24:2, 24:6, (See ibid.) 19 GRANTED. p. 25 ll. 11– (See ibid.) 20 12, 15, 17, GRANTED. 21 p. 27 ll. 4, 12, (See ibid.) 23, 22 GRANTED. 23 28:19, (See ibid.) GRANTED. 24 31:9, (See ibid.) GRANTED. 25 Dkt. No. Dkt. No. After “Sunny Redacting this personally identifying information 135-1 179-1 Choi” in 1, unrelated to the merits is warranted for privacy. 26 (Choi Exh. GRANTED. 27 A) After “Your So too for these personal financial details (see base previous entry). ! GRANTED. 2 Before (See ibid.) “shares of the 3 Company” in 2, GRANTED. 4 Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 135-5 & 189-10.) 5 135-5 189-10 name im (Exh. A, q 164, 6 Excerpts of GRANTED. Expert Customer (See ibid.) 7 Heinemann names in Reb. Rpt.) figs. 10-11, 8 GRANTED. 9 Like Splunk before, Crib] fails to articulate facts figs. 10-11, to warrant sealing this material (see ibid.). 10 DENIED. 11 B. SPLUNK’S OPPOSITION TO CRIBL’S MOTION FOR SUMMARY JUDGMENT. a 12 i Splunk’s Proposed Redactions. 13 || [Sealed | Public |ResultRe |Reasoning “4 Dkt. No. Dkt. No. | Customer An extended cut of this excerpt was promised for [134-9] 189-32; | names in attachment to the substantive motion, but not B45 (Exh. 18, cf. Dkt. 29:16; provided (see Dkt. Nos. 148-1 & 151-1 at vin.1). Excerpts of | No. 151- | 30:6—21; Regardless, the public filing attached to the a 16 Rottenberg | 4 31:2, 31:18; | omnibus motion, in connection with other copies Dep. Tr.) 41:9; of the same declaration, permits decision: 17 53:16-19, Redaction is not warranted (see supra entry re 3 18 DENIED. Dkt. Nos. 134-9 & 189-36). Dkt. No. Dkt. No. | Green 97, 116, 163, 174-78; nn.98, 100, 102-04, 19 148-55 167-3 highlights 133, 148—49, 153-57, 178-85, 203, 210; figs. 23, (Exh. 37, in 39, 43, 48 20 Excerpts of 7 97, These proposed redactions target source code, Expert 116, 163, directory names, and related minutia. Disclosure 21 Mitzen- 174-78; could harm Splunk’s commercial interests yet macher Op. nn.93, 98, would not meaningfully enhance public Rpt.) 100, understanding of the dispute. GRANTED. 23 102-04, 133, 148, Otherwise 24 149, Other proposed redactions include conceptual 153-57, steps in reverse engineering that were also 25 178-85, described in open court and relevant to the merits 6 203, 210; (e.g., nn.93). Still others were marked for figs. 23,39, | redaction but not provided any rationale (nn.122). 43, 48, Others were given a rationale but do not exist in GRANTED- the excerpt (nn.152—68). Perhaps there is a detail 28 IN-PART,

DENIED-IN- within the remainder that could have been granted 1 PART. if isolated for decision; none was. DENIED. 2 Green Fig. 20 highlights This excerpt of code could cause harm if 3 in disclosed and is beyond the detail needed to ¶¶ 165, understand the dispute. GRANTED. 4 172–73; figs. 3–20, Otherwise 5 GRANTED- Many of the proposed redactions are not 6 IN-PART, contained in this excerpt at all (figs. 3–19; ¶ 172). DENIED-IN- And much of the rest targets protocol and 7 PART. implementation concepts that went unredacted in other filings. Even here, some went unredacted in 8 a footnote on this same page (n.196), others went without rationale for redaction on the next page 9 (¶¶ 166–67) (see supra Part 3.A). DENIED. 10 Dkt. No. Dkt. No. DENIED. Expert Mitzenmacher testified in open court to 157 167-4 highlighted subject matter, and other filings 11 (replacing released more of the same (supra Part 3.A). Dkt. No. 12 148-4) (Exh. 41, 13 Excerpts of 14 Expert Mitzen- 15 macher Dep. Tr.) 16 Dkt. No. Dkt. No. Green Figs. in ¶¶ 83–86 17 148-13 167-14 highlights These proposed redactions cover specific opcodes (Exh. 70, in and other commercially important information not 18 Excerpts of ¶¶ 58–59, generally known. Disclosing them would impose Expert 61, needless costs on Splunk, given they go beyond 19 Astrachan 75–86, the detail needed to understand the case. 20 Op. Rpt.) 88, GRANTED. GRANTED- 21 IN-PART Otherwise AND Proposed redactions include the definition of 22 DENIED-IN- “S2S.” Perhaps some detail might have merited PART. redaction, but “the proponent of sealing bears the 23 burden” to specify. Kamakana, 447 F.3d at 1182 24 (see also supra Part 3.A). DENIED. Dkt. No. Dkt. No. Green Figs. 14, 19–21, 23–25, 27–29 25 148-18 167-19 highlights These proposed redactions are discrete and (Exh. 75, ¶¶ 24, 28, administrable. The figures compactly present 26 Excerpts of 34–37, code excerpts, file structures, and other details Expert 71, 73, 79, that could pose commercial harm if disclosed, yet 27 Mitzen- 80, that would not meaningfully enhance public macher 101, 103, | Reb. Rpt.) 104: Otherwise 2 nn.28, Other proposed redactions include material 31-34, covered in open court filings, in open court, and 3 79, in public sources — and related to the merits (see 80, 82, supra Patt 3.A). Indeed, proposed redactions 4 92, mask phrases so basic to the expert’s report 5 106, 129: attached to this dispositive motion that a term figs. 14, proposed to be redacted three times in one 6 19-21, paragraph appears also in the report’s section title 23-25, just above it (p. 16). If there were any golden 7 27-29, nuggets here, it was counsel’s job to remove them GRANTED- from the mine run (Dkt. No. 141). Cf 8 IN-PART Greenwood v. FAA, 28 F.3d 971, 977 (9th Cir. 9 AND 1994). DENIED. DENIED-IN- 10 PART. Dkt. No. Dkt. No. | Green Proposed redactions describe in general terms 11 161 (167-53) | highlights what Cribl did to discover and achieve (replacing in § 96, interoperability with Splunk. That description is 2 12 Dkt. No. DENIED. important to understanding case contentions. 148-50) Similar descriptions were offered in open court (Exh. 114, (see supra Part 3.A). 14 Excerpts of Expert 2 15 Mitzen- 16 macher = Reply Rpt. 17 sa . il Cribl’s Proposed Redactions. 1g || [Sealed | Public | ResultRe | Reasoning Dkt. No. Dkt. No. Customer (See supra entry re Dkt. No. 134-9 & 189-32.) 19 [134-9] 189-32; cf. | names in (Exh. 18, Dkt. No. 29:16; 30:6, 20 Excerpts of | 151-4 30:11, 30:21: Rottenberg 31:2, 31:18; Dep. Tr.) 41:9, 22 DENIED. Dkt. No. Dkt. No. Customer (See supra entry re Dkt. No. 147-5 & 149-17). 23 148-3 167-2 name in 3:4, (Exh. 3, GRANTED. 24 L. Bitincka Customer 5 Dep. Tr.) name in 3:7, GRANTED. 26 Dkt. No. Dkt. No. Lines of code | The short lines of code were already disclosed in 148-6 167-6 at -699, the same document admitted as an unredacted 27 xh. 62 DENIED. trial exhibit (Dkt. No. 352-55). 28

Slack Email The proposed redactions are of an email list 1 Msg., addresses in containing numerous personal addresses. Even if 2 CRIBL_ -707, disclosed elsewhere, this copy invites increased 00858847) GRANTED. spam, harassment, or other risks for third parties, 3 without adding any public benefit. Dkt. No. Dkt. No. Email address Redacting this individual’s personal email 4 148-8 167-8 in -112, address is warranted (see previous entry). 5 (Exh. 64, GRANTED. Email, Phone Redacting this individual’s phone number is 6 CRIBL_ number in warranted (see previous entry). 00989112) -114, 7 GRANTED. Dkt. No. Dkt. No. Customer These same customer names were disclosed in 8 148-10 167-10 names in the same document admitted as an unredacted (Exh. 66, -87, trial exhibit (Dkt. No. 352-64). Moreover, 9 Kentucky DENIED. customer names here are cited in “Customer 10 Fried Cribl, Stories” and touted on Cribl’s website. CRIBL_ After “our Redacting this customer’s name is similarly 11 00966079) future” in warranted (see also previous entry). -91, 12 DENIED. 13 Before “buys (See ibid.) are likely” in 14 -91, DENIED. 15 Canvas of (See ibid.) customer 16 names at -92, 17 DENIED. Dkt. No. Dkt. No. Customer This customer’s name is not stated alongside 18 148-13 167-14 name at ¶ 126, anything that would pose risk to Cribl or the (Exh. 70, DENIED. third party if reassociated with it. 19 Expert ¶ 212, This customer’s name was disclosed in court. 20 Astrachan DENIED. Moreover, while this paragraph discusses Op. Rpt.) technical issues, it lacks detail and recency and 21 so any threat from disclosure. ¶ 214, Redactions mask not only the customer’s name 22 DENIED. but the fact the customer found a problem Cribl had not. And the same ticket was disclosed in an 23 unredacted exhibit (Dkt. No. 352-27). 24 Customer’s However, this image of a ticket that includes a name and customer name embedded in technical details 25 technical about that customer merits redaction. Disclosing identifiers in it could expose more detailed technical 26 fig. in information about the customer that could injure ¶ 215, Cribl or the customer, that were not clearly 27 GRANTED. disclosed elsewhere, and that are beyond the Dkt. No. Dkt. No. Customer The redactions obscure the name of a customer 1 148-14 167-15 name in - interviewed extensively and confidentially about 2 (Exh. 71, 5185–86, its use of Cribl and Splunk. Sharing the resulting Cribl GRANTED. details benefits the public’s understanding of the 3 Interview, case, while redacting the name is warranted to CRIBL_ preserve third-party confidences and Cribl’s 4 00145171) relationships. Dkt. Dkt. No. Customer This software development ticket is tagged with 5 No. 148-17 167-18 name in customers benefiting from the work — all but 6 (Exh. 74, 163, one disclosed in a related ticket admitted as an Jira Ticket, DENIED. exhibit in court (see Dkt. No. 352-12). 7 CRIBL_ 00000163) 8 Dkt. No. Dkt. No. Code in This code used to trace a software issue is 148-23 167-24 -8796–97, beyond the detail required for public 9 (Exh. 80, GRANTED. understanding and may injure Cribl if disclosed. 10 Slack Code in (See previous entry.) Msg., -8802–03, 11 CRIBL_ GRANTED. 00858795) 12 Dkt. No. Dkt. No. -9036–37, This third-party prospect’s name is mentioned in 13 148-24 167-25 DENIED. passing and only in connection with information (Exh. 82, five years stale. Redaction is not warranted. 14 Slack Customer (See previous entry.) Msg., name in 15 CRIBL_ -9040–42, 16 00859033) DENIED. Dkt. No. Dkt. No. Third-party The document contains short notes on progress 17 148-25 167-26 names in gaining Cribl customers five years ago. Cribl (Exh. 83, -6584, does not articulate a persuasive reason to redact. 18 “Take DENIED. Home 19 Idea,” CRIBL_ 20 00856584) 21 Dkt. No. Dkt. No. After “Sunny (See supra entry re Dkt. Nos. 135-1 & 179-1.) 148-30 167-31 Choi” in 1, 22 (Exh. 89, GRANTED. Choi After “Your (See ibid.) 23 Emplymnt. base salary” 24 Letter) in 1, GRANTED. 25 Before (See ibid.). “shares of the 26 Company” in 27 2, GRANTED. (Exh. 92, Dkt. No. Email address Email address Msg., “mailto:” in - (cf. supra entry re Dkt. Nos. 148-6 & 167-6). 1 CRIBL_ 406, GRANTED. 2 00998405) GRANTED-IN- PART, Otherwise 3 DENIED-IN- The messaging was disclosed (Dkt. No. 352-63). PART. DENIED. 4 Dkt. No. Dkt. No. Personal Redacting this personal email address is likewise 148-34 167-36 email address warranted even if another copy exists as a needle 5 (Exh. 95, in -6641, in another haystack (see previous entry). 6 Invention- GRANTED. Assign’t 7 Agrmnt., CRIBL_ 8 00006635) Dkt. No. Dkt. No. Email Redacting this lengthy list of email addresses 9 148-35 167-37 addresses in appearing in a log (and in a letter) is warranted to 10 (Exh. 97, PDF pp. avoid annoyance and abuse to third parties Splunk 3–11, without corresponding public benefit. 11 Logs) GRANTED. Dkt. No. Dkt. No. Customer The same ticket was admitted as an unredacted 12 148-40 167-42 name in exhibit at trial (Dkt. No. 352-27). 13 (Exh. 102, -936, Jira Ticket, DENIED. 14 CRIBL_ Customer (See previous entry.) 00000936) name in -940, 15 DENIED. Dkt. No. Dkt. No. -49, These same customer names were already 16 148-44 167-46 DENIED. disclosed in the same document admitted as an 17 (Exh. 106: unredacted trial exhibit (Dkt. No. 352-55). Slack -52, (See previous entry.) 18 Msg., DENIED. CRIBL_ 19 00858847) Dkt. No. Dkt. No. Customer This transcript of a call with a customer includes 20 148-46 167-48 name in confidential details. Disclosing the customer 21 (Exh. 108, header name alongside them would directly divulge CRIBL_ 1–25, third-party confidences and could injure Cribl; 22 00077503. GRANTED. redacting the name avoids those harms while MP4) retaining all that is needed for understanding. 23 Dkt. No. Dkt. No. Customer (See previous entry.) 24 148-47 167-49 name in (Exh. 109, header 25 CRIBL_ 1–24, 00072913. GRANTED. 26 MP4) Dkt. No. Dkt. No. Third-party These service meeting notes include confidential 27 148-48 167-50 name or business and technical details about a third party. Meeting identifiers in| The identifiers of that party merit redaction (see 1 Notes, -651-52, ibid). 2 CRIBL _ GRANTED. 00607651 3 Dkt. No. Dkt. No. Third-party The proposed redactions obscure customer and 148-53 167-56 names in employee names from a technical 4 (Exh. 118, -437-43, troubleshooting conversation just one year ago. 5 CRIBL _ GRANTED. Associating those third parties with those details 00098435) would divulge confidences and could injure 6 Cribl; redacting names avoids those harms while retaining all that is needed for understanding. 7 Dkt. No. Dkt. No. Email address | Disclosing this personal email address would 148-54 167-57 in -2341, risk annoyance and abuse for a third party but 8 (Exh. 119, GRANTED. not aid public understanding of the case. 9 CRIBL_SC 002334 10 C. CRIBL’S REPLY IN SUPPORT OF ITS MOTION FOR SUMMARY 11 JUDGMENT. 12 i Splunk’s Proposed Redactions. Sealed Public___| ResultRe | Reasoning 13 Dkt. No. Dkt. No. | Customer Redactions are warranted for reasons like those 175-3 176-5 names in described for the same underlying passage (see (Exh. C, 2:16-2:17; | supra entry re Dkt. Nos. 147-5 & 149-17.) B15 Excerpts of 3:45, 3:7, L. Bitincka GRANTED. 16 Dep. Tr.

2 ii, Cribl’s Proposed Redactions. |Sealed | Public___| ResultRe __| Reasoning Zz 18 Dkt. No. Dkt. No. | Personal (See supra entry re Dkt. Nos. 147-7 & 149-21.) 19 175-1 176-3 physical (Exh. A, address 20 D. 8:12-8:13, Bitincka GRANTED. 21 Dep. Tr. Dkt. No. Dkt. No. Customer This exhibit list contains two customer names. 22 175-2 204-9 names at One was discussed in open court. Neither is 3 (Exh. B, p. 8 1. 5,7, associated here (directly or by citation to Sharp 10, 13-14, documents) with confidences undisclosed. 24 Dep. Tr. DENIED. Dkt. No. Dkt. No. | Customer The redactions are granted for the reasons stated 25 175-3 176-5 names at earlier (see supra re Dkt. Nos. 148-3 & 167-2). 6 (Exh. C, 2:16, L. 3:4, 3:7, 7 Bitincka GRANTED. Dep. Tr. 28

4. MOTIONS TO SEAL STEMMING FROM SPLUNK’S MOTION TO 1 EXCLUDE OPINIONS OF EXPERT MATTMANN. 2 Splunk moved to exclude opinions of Expert Mattmann (Dkt. No. 137). Cribl opposed 3 (Dkt. No. 145). Splunk replied (Dkt. No. 174). Parties’ omnibus motions declare support for 4 sealing particular passages. This order rules as follows: 5 A, SPLUNK’S MOTION To EXCLUDE OPINIONS OF EXPERT 6 MATIMANN. i Splunk’s Proposed Redactions. 7 || [Sealed [Public [ResultRe [Reasoning 8 Dkt. No. Dkt. No. | Customer The expert report describes a feature gap between 136-3 189-11 name in Cribl and Splunk relevant to the merits. The 9 (Exh. 1, ¥ 104, name of one prospective customer from this Expert DENIED. period years ago is mentioned. Splunk does not 10 Mattmann state a plausible basis for redaction. Op. Rpt. VW Dkt. No. Dkt. No. | Customer The expert report discusses instances when Cribl 12 136-4 189-12 names in performed work, and whether that work merely (Exh. 2, 26-29, solved software interoperability problems or did 13 Expert 38, something more for customers, a fact relevant to Mattmann 77, the merits. Proposed redactions target customer 14 Reb. Rpt.) 81, 82, 85, names, nearly all of which were disclosed in open 2 1s 86, 89, court, admitted exhibits, or other filings, often 90, related to these episodes. Together in this 5 16 100, 108; presentation they do not readily create a list. n.12, Splunk’s rationale for redaction is not persuasive = 17 DENIED. (see also supra entry re Dkt. Nos. 147-1 & 149-1 | 77). Zz 18 Dkt. No. Dkt. No. | Financial The proposed redaction obscures expenditures of 19 136-5 189-13 terms in a customer discussed generally in open court, but (Exh. 3, q 20, not granularly as here. Associating the customer 20 Expert GRANTED. name with the financial details could divulge Mattmann third-party confidences and pricing-related 21 Reply insights, but redacting the name or the finances Rpt.) reduces or eliminates those risks. In this specific 22 instance, preserving the name of the party but 3 obscuring the financial details better aids public understanding, and tracks what occurred in court. Customer Splunk’s reasons for redacting these customer’s names in names are not compelling. One customer was the 25 □□ 20, subject of testimony in open court. Others appear 33, on software tickets related to this discussion that 26 75, 77, were disclosed in trial exhibits. A last customer is 7 DENIED. mentioned with respect to a technical proposal from four years ago. 28

Dkt. No. Dkt. No. | Personally Disclosing this personal contact information | 136-12 137-18, | identifying would risk annoyance and abuse for a third party 2 (Exh. [17], | 189-21 information | but not aid public understanding of the case. Excerpts of in 3 Cribl’s 10:8-13:18, Third Amd. GRANTED. 4 Initial 5 Disclosures Dep. of 6 Expert Mattmann. 7 ii Cribl’s Proposed Redactions. 8 || [Sealed | Public | ResultRe _| Reasoning Dkt. No. Dkt. No. p. ill. 6, 15, This customer name was disclosed in open court 9 136-1 204-16 DENIED. and in a court order (and in dispositive motions 10 (Mot.) (As above), and aids the public’s understanding of discussed the case (see, e.g., Dkt. No. 373 at 8). Nothing 11 in Dkt. merits different treatment here. No. 224-1) (See previous entry.) 28, DENIED. 3 (See ibid.) DENIED. p.311.3,5, | (See ibid.) 12-13, 15 DENIED. p. 7 ll. 2, 4, (See ibid.) Bo DENIED. (See ibid) Z 18 9,11-12, 15, 20, DENIED. 19 (See ibid.) 27-28, 20 DENIED. 1 (See ibid.) DENIED. 22 p.1511.1,2, | (See ibid.) 11-12, 15-19, 23 22, 26-28, 24 DENIED. p- 16 11.3,5, | (See ibid.) DENIED. 26 (See ibid) 7, 15, 27 DENIED. 28

Dkt. No. Dkt. No. ¶ 102, This excerpt was quoted in the motion above, 1 136-3 189-11 DENIED. and the substance of these same redactions 2 (Exh. 1, addressed there (see supra entry re Dkt. Nos. Expert 136-1 & 204-16 at 15). 3 Mattmann Op. Rpt.) 4 Dkt. No. Dkt. No. Customer (See supra entries re Dkt. Nos. 136-4 & 189-12; 136-4 189-12 names in infra entry re Dkt. Nos. 142-9 & 189-73.) 5 (Exh. 2, ¶¶ 27–29, 6 Expert DENIED. Mattmann ¶ 36, This single customer was disclosed and 7 Reb. Rpt.) DENIED. discussed extensively in open court. ¶ 77, (See supra entry re Dkt. Nos. 147-1 & 149-1.) 8 DENIED. 9 ¶¶ 81–82, (See supra entries re Dkt. Nos. 136-4 & 189-12; DENIED. infra entry re Dkt. Nos. 142-9 & 189-73.) 10 ¶ 100, (See ibid.). DENIED. 11 ¶ 108, (See ibid.). 12 DENIED. Dkt. No. Dkt. No. ¶ 14, This customer name was disclosed in open court 13 136-5 189-13 DENIED. and in an order, and aids public understanding (Exh. 3, (e.g., Dkt. No. 373 at 8). 14 Expert ¶ 20, (See supra entry re Dkt. No. 136-5 & 189-13). Mattmann GRANTED-IN- 15 Reply Rpt.) PART, 16 DENIED-IN- PART. 17 ¶ 24, Redactions are not warranted for reasons similar DENIED. to other entries in this section (e.g., supra entry 18 re ¶ 14). Customer (See supra entry re Dkt. No. 136-5 & 189-13 19 names in ¶ 33.) 20 ¶ 33, DENIED. 21 Customer The customer name was disclosed in open court name / IDs in and other filings. The technical information 22 ¶ 37, appearing alongside is four years old. There is 23 DENIED. no persuasive reason to redact. Customer (See previous entry.) 24 name in ¶ 68, 25 DENIED. ¶ 77, (See supra entry re Dkt. No. 136-5 & 189-13 26 DENIED. ¶ 77.) 27 Dkt. No. Dkt. No. 49:20, This customer was discussed in open court (see (Exh. 4, 131-37). Nothing in these passages presents a | Expert risk to the third party or Cribl if exposed. 2 Mattmann (See previous entry.) Dep. Tr.) DENIED. 3 (See ibid.) DENIED. 4 (See ibid.) 5 DENIED. 248:4, (See ibid.) (See ibid.) 7 DENIED. 253:19-20, | (See ibid.) 253:23-24; 9 254 Il. 5, 9- 10, 14, 16, 19, 10 24, DENIED. (See ibid.) 1 DENIED. 256:7, (See ibid.) & 13 DENIED. _ 257:11-12, (See ibid.) 5 DENIED. Dkt. No. Dkt. No. Customer The document presents a table showing customer 5 16 136-8 204-7 names in savings for a list of customers. Exposing the list (Exh. 9, exh. 7, would reveal confidential information about 17 Expert GRANTED. those third parties and could cause harm to them Putnam and Crib! without meaningfully advancing Zz 18 Op. Rpt. understanding of the case. 19 Dkt. No. Dkt. No. Personally Disclosing this personal contact information 136-12 189-21 identifving would risk annoyance and abuse for third parties 20 (Exh. 17, information in | but not aid public understanding (see supra entry Cribl’s 3d 4-9, te Dkt. Nos. 136-12 & 189-21). 21 Amd. GRANTED. CMO 22 Discls. 23 B. CRIBL’S OPPOSITION TO SPLUNK’S MOTION To EXCLUDE OPINIONS OF EXPERT MATTMANN. 5 i Splunk’s Proposed Redactions. Sealed | Public | ResultRe_ [Reasoning 6 Dkt. No. Dkt. No. | Customer Here, the opposition brief quotes the expert 144-1 145 name and report. The reason for denying the proposed 27 (Opp.) ID in redaction in the underlying report applies also to 18:21; the brief (see supra entry re Dkt. Nos. 136-5 & 28 189-13 § 20).

Sf ! DENIED. 2 License (See previous entry.) revenue in 3 18:23— 18:24, 4 GRANTED. 5 Dkt. No. Dkt. No. | Customer (See supra entry re Dkt. Nos. 136-3 & 189-11.) 144-4 145-4 name in 6 (Exh. C, 4 104, Se 7 Expert Mattmann 8 Op. Rpt. 9 Dkt. No. Dkt. No. | Customer (See supra entry tre Dkt. Nos. 136-5, 189-13 144-6 145-8 names, IDs 7 20, 33.) 10 (Exh. G, in Excerpts of 20, 33, 11 Expert DENIED. Mattmann Financial (See ibid.) 12 Reply Rpt.) amounts in 120, GRANTED. 14 6 il Cribl’s Proposed Redactions. 15 || |Sealed | Public | ResultRe _| Reasoning Dkt. No. Dkt. No. Customer Testimony in court included the affiliation of this a 16 144-1 145 name im expert, which is helpful to understanding the 3 17 (Opp.) 3:23, 3:28, case (see, e.g., Dkt. No. 373 at 8). DENIED. 18 (See previous entry.) 20, 23, 19 DENIED. 70 (See previous entry.) DENIED. 21 Customer (See previous entry; see also supra entry re Dkt names in Nos. 144-1 & 14 at 18:23—24 (granting limited 22 17-19, redactions re financial figures). DENIED. 23 Dkt. No. Dkt. No. Customer Again, testimony in open court revealed this 24 144-2 145-1 name in customer and its general use cases (see e.g., Dkt. (Decl.) 1:17; 2:25, No. 373 at 8). 25 DENIED. Dkt. No. Dkt. No. (See previous entry.) 26 144-3 145-2 DENIED. (Exh. A, 122:3; The identity of this customer’s employee was 27 Expert 123:6—7, disclosed in open court and trial exhibits, and 28 Mattmann 123:15, there is no special reason to redact here.

Dep. Tr. DENIED. 1 Excerpts) 218:18, Redactions are not warranted for reasons like 2 DENIED. those stated above (see supra entry re Dkt Nos. 144-1 & 145.) 3 Dkt. No. Dkt. No. ¶ 102, (See supra entry re Dkt. Nos. 136-3 & 189-11 144-4 145-4 DENIED. ¶ 102.) 4 (Exh. C, Expert 5 Mattmann 6 Op. Rpt.) Dkt. No. Dkt. No. Email Email addresses and organizational IDs 7 144-5 145-7 addresses and The document is an email among a customer’s (Exh. F, third-party employees about a meeting with Cribl. For 8 Email re names in reasons articulated before, redaction is warranted Cribl -878, (see supra entry re Dkt. Nos. 148-6 & 167-6). 9 discussion, GRANTED-IN- 10 CRIBL_ PART, Otherwise 00863878) DENIED-IN- Several people involved in this email were 11 PART. discussed in open court, and the email was admitted as an exhibit (Dkt. No. 352-84). 12 Dkt. No. Dkt. No. ¶ 14, (See supra entry re Dkt. Nos. 136-5, 189-13.) 13 144-6 145-8 DENIED. (Exh. G. Customer (See ibid.) 14 Expert name in Mattmann ¶ 20, 15 Reply Rpt.) DENIED. Customer (See ibid.) 16 financial 17 figures in ¶ 20, 18 GRANTED. ¶ 24, (See ibid.) 19 DENIED. 20 Customer (See ibid.) names in 21 ¶ 33, DENIED. 22 Customer (See ibid.) names in 23 ¶ 37, 24 DENIED. ¶ 68, (See ibid.) 25 DENIED. Dkt. No. Dkt. No. 24 n.37, The cited footnote briefly mentions an analysis 26 144-7 189-9 DENIED. made by an investment firm. The proposed (Exh. H, redaction would obscure the firm’s name. But 27 Excerpts of that name goes unredacted elsewhere in other Puma ff copies of the report, and nothing about this | Op. Rpt. reference merits different treatment. 2 Dkt. No. Dkt. No. Third-party The document is a purchase order for Cribl. In 144-8 145-11 names, the context here, redacting the customer’s name 3 (Exh. J, addresses, and contact details (and those of its employees) 8/20/2020 phone is warranted to make more difficult re- 4 Purchase numbers, associating them with the contract terms, which 5 Order, 14, would divulge specific confidences and injure CRIBL __ GRANTED. Cribl without enhancing public understanding. 6 00069509) Price paidin | The price paid 1s disclosed to the public on other 4, pages not marked for redaction. And, given the 7 DENIED. third-party name is redacted, Cribl’s feared harm from disclosing one customer’s price is not 8 persuasive. 9 Dkt. No. Dkt. No. Customer and | This is a document describing how Cribl will 144-9 145-12 employee conduct its proof-of-concept for this customer. 10 (Exh. K, name and The document elaborates some technical details POC contact in about the customer that could harm it if 11 Planning -7619, reassociated with it. Redaction is warranted. and GRANTED. 12 Execution Customer and | (See previous entry.) E Document, employee CRIBL_ name and 14 00077619) contact in 9 -7623, 2 15 GRANTED.

a 16 C. SPLUNK’S REPLY IN SUPPORT OF ITS MOTION To EXCLUDE 3 OPINIONS OF EXPERT MATIMANN. Only Cribl proposes redactions here. ~ 18 || [Sealed [Public |ResultRe | Reasoning 19 Dkt. No. Dkt. No. | p.ill. 9, The customer’s name was disclosed in other 173-1 174 DENIED. documents and in court, and nothing here merits 20 (Br.) particular treatment (cf supra entry re Dkt. Nos. 136-5 & 189-13). 21 (See previous entry.) 14, 22, 22 DENIED. 23 p. 411. 10, (See ibid.) 24 DENIED. 24-25, 26 DENIED. p. 911. 1,3, (See ibid.) 27 11, 15, 20, 28 DENIED.

p. 1011.2-4, | (See ibid.) 1 8-10, 12-13, 2 DENIED. 3 5. MOTIONS TO SEAL STEMMING FROM CRIBL’sS MOTION TO 4 EXCLUDE OPINIONS OF EXPERT ASTRACHAN. 5 Likewise, Cribl moved to exclude opinions of Expert Astrachan (Dkt. No. 130). Splunk 6 opposed (Dkt. No. 156). Parties’ omnibus motions again declare support for sealing particular 7 passages. This order rules as follows: 8 A, CRIBL’S MOTION TO EXCLUDE OPINIONS OF EXPERT 9 ASTRACHAN. i Splunk’s Proposed Redactions. 10 || [Sealed Public | ResultRe Reasoning Dkt. No. Dkt. No. | Code Fig. in ¢ 180 129-2 179-9 details in The screenshots show lists of specific opcodes 12 (Exh. 1, 99 (177, and key-value pairs that are not generally known, Excerpts of 180, that are beyond the level of the detail disclosed in 13 Expert GRANTED- court or needed to understand the case, and that Astrachan IN-PART, could injure Splunk if disclosed. GRANTED. 2 i Op. Rpt.) DENIED-IN- . 15 PART. Otherwise The other redactions target general concepts or 16 code features already known or disclosed in other filings and testimony. Splunk’s rationale for 2 17 redaction 1s not persuasive (supra Part 3.A). Dkt. No. Dkt. No. | Marked The code repository and commit identifiers here 18 129-8 179-12 redactions are details beyond the scope of anything discussed 19 (Exh. 7, in2 & n.2, in court. Disclosing them could present risks to 2023-07-14 GRANTED. Splunk and for no benefit to public understanding. 20 Ltr. fr. Roddy to 21 Pearson 22 ii Cribl’s Proposed Redactions. 53 || [Sealed | Public | ResultRe __| Reasoning Dkt. No. Dkt.No. | 9361 The passage recalls that Cribl advertises it can 4 129-3 204-3 DENIED. reduce the data transmitted to Splunk. It (Exh. 2, mentions the name of a third party that received 25 Expert such marketing. Cribl does not present a Astrachan persuasive reason to redact that one party’s 26 Reb. Rpt. name. Excerpts 28

B. SPLUNK’S OPPOSITION TO CRIBL’S MOTION TO EXCLUDE 1 OPINIONS OF EXPERT ASTRACHAN. 2 i Splunk’s Proposed Redactions Sealed | □□□□□□□□□□□□□□□□□□□□□□□□□□□□□ 3 Dkt. No. Dkt. No. | Coding A previous entry’s reasoning leads to the same 4 153-2 189-47 details in result here regarding the same passage (see Dkt. (Exh. 1, 9 177-80, Nos. 129-2 & 179-9 177-80). 5 Excerpts of GRANTED- Expert IN-PART, 6 Astrachan DENIED-IN- 7 Op. Rpt. PART. 8 i Cribl’s Proposed Redactions. |Sealed Public___| ResultRe__| Reasoning 9 Dkt.No. | Dkt. No. (See supra entry re Dkt. Nos. 148-13 & 167-14.) 153-2 189-47 DENIED. 10 (Exh. 1, q 193, This customer’s name was mentioned in open u Expert DENIED. court. Cribl does not persuade that its use here, Astrachan years ago requesting something since provided, 12 Op. Rpt.) creates any risk to Cribl or the third party. 4] 212-15, The image (within § 215) merits redaction but 13 GRANTED-IN- | other portions do not (see supra entry re Dkt. a ParRT, Nos. 148-13 & 167-14 §§ 212, 214, 215). PART. —______ Two customer names are mentioned in passing 16 name in with respect to service issues completed years q 226, ago. Redaction is not warranted. = 17 DENIED. 6 4 253 This passage presents a ticket respecting a 18 service issue and includes a customer name. The 19 ticket was disclosed 1n trial (Dkt. No. 352-6). Dkt. No. Dkt. No. Customer The passage describes how Cribl uses Splunk in 20 153-3 189-48 name in connection with marketing. In passing, it cites (Exh. 2, 312, 361 third parties who received such presentations, 21 Expert DENIED. and cites to documents not readily available. Astrachan There is no remaining reason to redact. Reb. Rpt. 23 Dkt. No. Dkt. No. 343:4, (See supra re Dkt. Nos. 133-23 & 131-37 at 153-9 189-54 DENIED. 343:4.) 24 (Exh. 15, Expert 25 Mattmann %6 Dep. Tr. 27 28

6. MOTIONS TO SEAL STEMMING FROM CRIBL’S MOTION TO 1 EXCLUDE OPINIONS OF EXPERT MITZENMACHER. 2 Crib] also moved to exclude opinions of Expert Mitzenmacher (Dkt. No. 128). Splunk 3 opposed (Dkt. No. 143). Parties’ omnibus motions declare support for sealing particular 4 passages. This order rules as follows: 5 A, CRIBL’S MOTION TO EXCLUDE OPINIONS OF EXPERT 6 MITZENMACHER. Only Splunk proposes redactions here. 7 || [Sealed [Public [ResultRe [Reasoning 8 Dkt. No. Dkt. No. | Marked 16:14, 22:12 127-2 179-17 redactions at | Proposed redactions obscure code-related file 9 (Mot.) 5:25- 6:1; names that if disclosed could cause commercial 12:22-23; risk but not increase relevant public 10 13:10-11; understanding. GRANTED. 15:24-25, i 16:4-12, Otherwise 2 16:17-26, Redactions cover broad statements about the 22:12 &n.1, | general techniques Splunk uses, and asserts they E 43 DENIED. show Splunk’s creativity. Splunk asserted that such evidence supported its copyright claims, and 14 related testimony was heard in open court and 2 1s other filings (supra Part 3.A). DENIED. Dkt. No. Dkt. No. | Marked Figs. 1-2 5 16 127-4 179-2 redactions in_| These figures were not included in the excerpt, so (Exh. 1, q¥ 48-53, decisions as to them are moot. 17 Excerpts of 58, Expert 66-81, Figs. 3-20 z 18 Mitzen- 83-85; The redacted material illuminates in one place 19 macher Op. nn.37-47, characteristics of Splunk’s protocol Rpt.) 49,51, implementation not generally known that could 20 53-56, pose commercial risks if disclosed and that are 61-62, beyond the detail required to understand the case 21 65, 68, (cf. supra entry re Dkt. Nos. 148-55 & 167-3 70-79 fig. 20). GRANTED. 22 figs. 3— 20, 3 GRANTED- 49-53, 58; nn.37-46, 49, 51, 53-56, 70-72, IN-PART, 76-79 24 DENIED-IN-__| Proposed redactions cover commit identifiers, file Part. names, and the like — technical details that if 25 disclosed could cause commercial harm and that are beyond the detail required for understanding. 26 GRANTED. 27 [{ 48, 66-85; nn.47, 61, 62, 65, 68, 73-75 28

Testimony in court and other documents repeated | or paralleled much of what is proposed for 2 redaction here. Splunk’s redactions are overbroad, and for this reason its provided 3 rationale as to these redactions is not credible (see 4 supra Patt 3.A). DENIED.

5 ¥ 59; nn.69, 80-85 Redactions are marked but not provided a 6 rationale in Splunk’s motion (Dkt. No. 190 at 19). DENIED. 7 Dkt. No. Dkt. No. | 999-104; Figs. 19-21, 23-25, 27-29 127-6 179-3 nn.124, These figures were not disclosed elsewhere. 8 (Exh. 2, 129, 141, Readily discernible as pertaining to one of 9 Excerpts of DENIED. Splunk’s rationales, they illuminate details of Expert 99 99, Splunk’s S2S implementation that could pose 10 Mitzen- 101, 103, commercial risks to Splunk if disclosed and that macher 104; are beyond the detail required to understand the 11 Reb. nn.124, 129, | dispute (see also supra entry re Dkt. Nos. 148-55 Rpt.) 132, 137, & 167-3 fig. 20). GRANTED. 138, 5 13 141, Figs. 22, 26 143, 144; These figures were already disclosed (see Dkt. Y 14 figs. 19-29, | No. 167-19). DENIED. 9 GRANTED- 2 15 IN-PART, Remaining redactions DENIED-IN-__| Splunk provides two rationales for redactions, and a 16 Part. no way to distinguish which rationale corresponds 7 with which redaction where both are cited for the = same note or paragraph. This makes unclear how 7 18 Splunk cabins each concern, and frustrates clear determinations by this order. Regardless, the 19 remaining redactions are overbroad, and are supported by boilerplate that cannot support the 20 breadth of redactions — much of which was 21 already disclosed (see, e.g., Dkt. Nos. 148-18 & 167-19 § 100; see also supra Part 3.A). DENIED. 22 Dkt. No. Dkt. No. | “Green Figs. 2-4, 8; 86-88; 127-8 179-4 highlighted | nn.51, 54, 63, 67, 69, 146, 151-53 23 (Exh. 3, portions” or | These selections abide the one rationale 74 Excerpts of marked pertaining to them. They contain source code and Expert redactions 11 | closely related information not generally known 5 Mitzen- 9 31, 35-37, | that could injure Splunk if disclosed and that goes macher 39,47, 86— □ beyond what is required for the public to 26 Reply 88; nn.51, understand the dispute. GRANTED. Rpt.) 54, 27 63, 64,67, | Otherwise 28 69, 146, Splunk sometimes provides two rationales for the

151-153; same passage, and sometimes no rationale □□□□□□□ | figs. 24,8, | n.55). This makes unclear how Splunk cabins 2 GRANTED- each concern. Regardless, the redactions are IN-PART, overbroad. Proposed redactions include, for 3 DENIED-IN-__| instance, that Expert “Feamster seems to argue Part. that simply because the idea of [redacted] is 4 16, 17, 20, | conventional, the specific [redacted] implemented 5 23,25,27— __| by Splunk engineers is not creative” (§ 35). The 40; nn.44, sentence advances factual claims that Splunk 6 52, 56, 60, asserted were relevant to the merits, and does so 62, 64, 68, using a term the sentence says is generic but that 7 DENIED. Splunk seeks to redact. The generic term was disclosed elsewhere, and related testimony was 8 heard in court. Splunk states no specific rationale 9 for redacting it here (see a/so Part 3.A). DENIED. Dkt. No. Dkt. No. | “Green Figs. 1-19; nn.204—07, 210, 213-22 10 127-10 179-5 highlight[s]” | These selections discernibly contain code (Exh. 4, in Ff 118, fragments, commit identifiers, and closely related 11 App’x B to 122, 127; information not generally known that could injure Expert n.202, Splunk if disclosed and that goes beyond what is 2 12 Mitzen- DENIED. required for the public to understand the dispute. 3 macher “Green GRANTED. Reply highlight[s]” 14 Rpt.) in FJ 118— Otherwise 126; nn.203— | Again, the redactions follow two overlapping 2 15 207, rationales and often there is no way to tell how 210, 213- Splunk intended to cabin them. Moreover, many a 16 232; figs. proposed redactions are of generic concepts 17 1-19, presented in open court. For instance, one GRANTED- “source code” redaction is as follows: “Splunk Z 18 IN-PART, made a creative choice in determining DENIED-IN-__| [redacted].” The redacted term is itself general 19 ParRT. and was noted elsewhere and in court. DENIED. 0 Dkt. No. Dkt. No. | 54:5—23, The redacted material addresses general concepts 127-12 179-6 DENIED. discussed in open court that Splunk asserted were 21 (Exh. 5, related to the merits (see supra Part 3.A). Excerpt of 22 Expert Mitzen- 23 macher Dep. 24 Tr. 5 Dkt. No. Dkt. No. | Redactions (See supra entry re Dkt. Nos. 129-8 & 179-12.) 127-14 179-7 in? & n.2, 26 (Exh. 6, GRANTED. 2023-07-14 27 Ltr. Roddy 28 to Pearnon

Dkt. No. Dkt. No. | 99251, The paragraphs track testimony in open court, | 127-18 189-5 252, describing generally how protocols work and 2 (Exh. 9, DENIED. some of the activities done to understand this one Excerpts of (see supra Part 3.A). 3 Expert Feamster 4 Op. Rpt. 5 Dkt. No. Dkt. No. | Marked Proposed redactions include fragments for which 127-20 189-6 techniques in | no rationale is offered (e.g., § 122). And they 6 (Exh. 10, 9 129-36 include generic concepts useful to understanding Excerpts of 138-39, case contentions, many repeated in open court. 7 Expert 142-44; For example: “This is a conventional software Feamster nn.7, 8, design in which [redacted] are emitted by a 8 Reb. Rpt.) DENIED. program at configurable [redacted] levels that can 9 be adjusted during development” (§ 142). Splunk fails to provide a specific reason why this general 10 description of this conventional design merits redaction (see supra Part 3.A). DENIED. 11 Marked code | 44 140-41; fig. in ¢ 138; nn.12-14 and These selections abide a proposed rationale. They 12 identifiers in | contain code fragments, commit identifiers, and S 23 9 121,132, | closely related information not generally known 138-142; that could injure Splunk if disclosed and that goes 14 nn.12—14 beyond what is required for the public to 9 GRANTED- understand the dispute. GRANTED. 15 IN-PART, 2 DENIED-IN- | Otherwise a 16 Part. See previous entry). DENIED. 17 Dkt. No. Dkt. No. | § 180, (See supra entry re Dkt. Nos. 129-2 & 179-9.) 127-22 189-7 GRANTED- Z 18 (Exh. 12, IN-PART, Excerpts of DENIED-IN- 19 Expert PART. Astrachan 20 Op. Rpt. 71 B. SPLUNK’S OPPOSITION TO CRIBL’S MOTION TO EXCLUDE 22 OPINIONS OF EXPERT MITZENMACHER. 23 i Splunk’s Proposed Redactions. |Sealed__| Public__| ResultRe | Reasoning 24 Dkt. No. Dkt. No. | Green 5:18-19, 9:6—7, 16:23-25, 18 n.3, 19:14, 20:3 142-1 189-63 highlights Passages pertain to specific code characteristics 25 (Opp.) in 5:18-19, | not discussed in open court that could impose 6 6:6—7:12, commercial risks if disclosed, and that are beyond 9:6—7, the detail required to understand the case. 7 10:6—20, GRANTED. 16:20-25, 28 19:14, 20:3; | Otherwise

n.3, No redactions are marked, and none would meet 1 GRANTED- the standard. The passages (e.g., 6:6–7:12, 10:6– 2 IN-PART, 10:20) describe generic or disclosed elements of DENIED-IN- the S2S protocol and its implementation (see 3 PART. supra Part 3.A). DENIED. Dkt. No. Dkt. No. ¶¶ 48–53 58, (See supra entry re Dkt. Nos. 127-4 & 179-2.) 4 142-2 189-66 66––81, 83– (Exh. 1, 85; nn.37– 5 Excerpts of 47, 49, 51, 6 Expert 53–56, 61– Mitzen- 62, 65, 68, 7 macher Op. 70–79; figs. Rpt.) 3–20, 8 GRANTED- 9 IN-PART, DENIED-IN- 10 PART. Dkt. No. Dkt. No. 54:5– 23, (See supra entry re Dkt. Nos. 127-12 & 179-6.) 11 142-3 189-67 DENIED. (Exh. 5, 12 Excerpt of Expert 13 Mitzen- 14 macher Dep. Tr.) 15 Dkt. No. Dkt. No. ¶¶ 157–62, ¶¶ 157–62, 164 142-5 189-69 164, 251, No highlights or redactions are marked. DENIED. 16 (Exh. 9, DENIED. 17 Excerpt of ¶ 251 Expert (See supra entry re Dkt. Nos. 127-18, 189-5.) 18 Feamster Code ¶ 167 Op. Rpt.) identifiers Redactions are of endpoints, tokens, and the like 19 in ¶¶ 167, that could impose risk if disclosed and that are 246, beyond what is required to understand the case. 20 GRANTED- GRANTED. 21 IN-PART, DENIED-IN- ¶ 246 22 PART. The passage concerns decompiling two JAR files. No redactions were published on the public copy. 23 The same material was elsewhere also left unredacted (e.g., Dkt. No. 179-3 at 58 & n.124). 24 DENIED. 25 Dkt. No. Dkt. No. ¶¶ 129– (See supra entry re Dkt. Nos. 127-20 & 189-6.) 142-6 189-70 136, 138– 26 (Exh. 10, 139, 42– Excerpts of 144; nn.7, 27 8, 1 Expert 94 121, (See ibid.) Feamster 132, 138—- 2 Reb. Rpt.) 142: nn.12— 14, 3 GRANTED- IN-PART, 4 DENIED-IN- 5 PART. Dkt. No. Dkt. No. | Customer (See supra entry re Dkt. Nos. 136-4 & 189-12.) 6 142-9 189-73 name in (Exh. 18 9 26-27, 7 Excerpt of DENIED. Expert 8 Mattmann 9 Reb. Rpt. 10 ii Cribl’s Proposed Redactions. |Sealed | Public___| ResultRe _| Reasoning 11 Dkt. No. Dkt. No. Customer (See previous entry.) 142-9 189-73 name in (Exh. 18. 19 26, 27,

3 B Expert DENIED. Mattmann 14 Reb. Rpt. So 15 7. MOTIONS STEMMING FROM CRIBL’S MOTION TO EXCLUDE A 16 OPINIONS OF EXPERT PUTNAM.

= 17 Cribl also moved to exclude opinions of Expert Putnam and for leave to supplement 6 Z 18 those of Expert Heinemann (Dkt. No. 126). Splunk opposed (Dkt. No. 155). Parties’ omnibus 19 motions again declare support for sealing particular passages. 20 A, CRIBL’S MOTION TO EXCLUDE OPINIONS OF EXPERT 21 PUTNAM. 22 Recall that Splunk sought damages. Experts opined what would have been Splunk’s 23 revenues and profits but for Cribl’s alleged contract and copyright violations, with different 24 answers provided depending upon the acts proven unlawful. Parties shared high-level financial 25 and operational information about each firm, overlapping customers, and resulting estimates. 26 Parties now propose redactions, however, that would obscure even those high-level 27 numbers. For its part, Splunk proposes to redact even financial information it reported as a 28 public company: “For FY2023, Splunk reported about [redacted] in revenue” (Dkt. Nos. 125-4

1 & 204-10 9 50). What would rivals, investors, and regulators say? $3.65 billion. Splunk 2 Announces Fiscal Fourth Quarter and Full Year 2023 Financial Results , SPLUNK.COM (Mar. 1, 3 2023), [https://perma.cc/66AF-TVUT]. And Cribl, meanwhile, seeks to redact claims it made 4 repeatedly in filings and open court as to whether Cribl was profitable and whether that 5 affected damages (compare, e.g., Dkt. No. 189-62 at 21, and Tr. 1272-76, with, e.g., Dkt. Nos. 6 125-2 & 204-2 at 20-21). Cribl also seeks to redact truisms about venture financing (e.g., Dkt. 7 Nos. 125-4 & 204-10 §f 27, 29, 162). And it seeks to redact widely quoted figures regarding 8 its valuation (e.g., id. § 28 & n.14). Such redactions are unwarranted. Many were discussed in 9 open court to aid the public’s understanding there, just as they are discussed here in filings. 10 And they protect nothing a rival or investor would not know, serving only to interrupt the 11 public’s understanding of disputed points. Specific examples will be noted below. 12 i Splunk’s Proposed Redactions. || [Sealed ___| Public _|ResultRe [Reasoning °° Dkt. No. Dkt. No. | Customer The document develops estimates of damages 14 125-4 204-10 names in based on public and private financial data and, in S (Exh. 1, JJ 106, some respects, Splunk-, Cribl-, and customer- 2 15 Expert 142-43; provided stories about the services. Putnam nn.178— 16 Op. Rpt.) 180, 182: nn.178-80, 182; exhs. 7, 8, 15 exhs. 6.1, These customer names are presented in locations 6.2, 6.4, 7, where they form large lists of Splunk’s (and 18 8, 10, 15, Cribl’s) customers, sometimes alongside their GRANTED- financial information. Redacting the names is 19 IN-PART, warranted to protect Splunk (and Cribl, infra), and DENIED-IN-__| third parties. GRANTED. 20 PART. 1 ¥{ 106, 142, 143; exhs. 6.1, 6.2, 6.4, 10 The customer names here were either already 22 disclosed or else are disclosed in isolated instances. Disclosing them poses no credible 23 threat to Splunk (nor to Cribl, infra). DENIED. Financial Multiple proposed redactions would obscure 24 information | information gleaned from public-company filings 25 in (e.g., § 50; compare also exh. 13 sched. B, with 50; id. at exh. 14.1 nn.6—7; see also supra Part 7.A). 6 exhs. 3.1, If there is financial information here that is not 3.2, 5; public and worthy of protecting, it is Splunk’s 27 exh. 13 sch. | burden to point that out. Kamakana, 447 F.3d at 28 B, 1182. This is not to foreclose any redaction that Cribl also seeks with better tailoring (see infra).

DENIED, 1 without 2 prejudice to Cribl’s 3 redactions. Dkt. No. Dkt. No. “Green and Splunk says that it wishes to redact highlighted 4 125-6 204-11 purple customer names across 132 pages of “Footnotes,” (Exh. 2, highlights” in “¶¶,” and exhibits. The Court ordered a passage- 5 Expert “¶¶” by-passage justification (Dkt. No. 141). That 6 Putnam “Footnotes” passage-by-passage approach helps ensure Reply “Exhibits 3, proposed redactions are important enough to call 7 Rpt.) 4”, out in a motion. And it keeps the process DENIED, administrable, ensuring the district court does not 8 without need to search for, perhaps not find, and even prejudice grant by mistake some portion of proposed 9 to Cribl’s redactions. Greenwood, 28 F.3d at 977 (“Judges 10 redactions. are not like pigs, hunting for truffles buried in briefs.”) This order does not credit Splunk’s 11 claim that the secrecy of every customer name (or of these ones) is so important to it. 12 Financial Although Splunk did not call out Exhibit 4 for study redaction in the opening report (perhaps knowing 13 information Cribl was requesting its redactions, infra), this 14 redacted in order credits Splunk’s basis for redacting the ¶ 124 updated exhibit in the reply. The paragraph and 15 Exhibit 4, exhibit call out the number of sales transactions GRANTED. across the study period and then the period-by- 16 period revenue from customers of various types, 17 cut once more by those overlapping with or not with Cribl. Although underlying what was to be 18 proved and what was shared publicly, these more detailed numbers are bound up with other non- 19 public information that would impose costs on Splunk (and Cribl, infra) if released. 20 Dkt. No. Dkt. No. 169:3; In one instance, the proposed redaction does not 21 125-8 204-12 195:17– match the rationale for redaction. In all others, (Exh. 3, 196:19; the single customer name was discussed in 22 Expert 197:12; attachments to dispositive motions. Here, no Putnam 198:14, adjacent details create risk to the third party or 23 Dep. Tr.) DENIED. Splunk (or Cribl, infra) if reassociated with it. Dkt. No. Dkt. No. Marked Figs. 10–11; exhs. 7.1–9.1 24 125-10 204-13 redactions These redactions entail third-party finances at a 25 (Exh. 4, in level of detail not needed to understand the Expert ¶¶ 2(l), 153, dispute, and go beyond what was disclosed 26 Heinemann 192, 196, elsewhere. Moreover, redacting just third-party Reb. Rpt.) 200; names but not the details is no solution here: The 27 n.319; sheer volume of examples, each with its specific figs. 10–14; meaningfully more confidential information about 1 exhs. 6.1– Splunk’s business than would any one such 2 9.1, example by itself. GRANTED. GRANTED- 3 IN-PART, n.319 DENIED-IN- The redaction specifically relates to the rationale 4 PART. for redaction and captures a confidential financial ratio of import to Splunk but beyond the detail 5 needed to understand the dispute. GRANTED. 6 ¶ 2(l) 7 Marked redactions surpass the rationale. The proposed redaction is not “pricing” nor 8 “expenditures of specific customers” (Dkt. No. 190 at 28). Rather, the high-level information 9 conveys estimated lost revenues across all 10 customers using Cribl instead of Splunk. That is on-point to the dispute, and akin to what was 11 disclosed elsewhere (see supra Part 7.A). DENIED. 12 ¶ 153 13 So too here: The redaction — “Splunk’s 14 ingestion volume from Cribl was only [redacted]% of Splunk’s total ingestion volume 15 tracked” (¶ 153) — does not cover “pricing” or “expenditures of specific customers,” nor even 16 “financial information” (Dkt. No. 190 at 28). Moreover, the same information is disclosed 17 elsewhere (e.g., Dkt. No. 189-10 ¶ 153). DENIED. 18 ¶ 192 19 Once again: The redaction does not protect Splunk’s or customers’ financial information as 20 such. Rather, the proposed redaction would 21 protect Splunk from disclosing the extent to which Cribl may have diverted sales from Splunk. 22 But that was one question Splunk sought the public courts to help answer. Splunk’s boilerplate 23 explanation for redacting high-level information about the answer, of the kind heard in court, is not 24 compelling. See Union Oil Co. of Cal. v. Leavell, 25 220 F.3d 562, 567–68 (7th Cir. 2000) (Judge Frank Easterbrook). And the number redacted 26 here is disclosed throughout the reports. DENIED.

27 ¶¶ 196, 200; fig. 14 1 Similar reasoning applies. Competing damages 2 theories were presented in open court. DENIED.

3 Figs. 12–13 These figures are at the heart of a damages 4 question Splunk brought to the public courts to answer. The boilerplate rationale for redaction 5 that Splunk provides is to protect its pricing and 6 related financial information. But not even private-company Cribl seeks to protect this 7 information, making Splunk’s fears less credible. Moreover, in another instance of this underlying 8 report, Splunk failed to move to redact these 9 figures, again belying its rationale. DENIED.

10 Exhs. 6.1–6.6 These charts are related to the figures above, but 11 divulge more gradations of information about the companies without meaningfully increasing 12 public understanding of the case. GRANTED. Customer ¶¶ 124, 171, 179; nn.243–257, 343, 347–50, 352– 13 names and 55, 357; exhs. 2.5, 3.9, 9.1–9.3, 10, app’x C 14 identifiers in The passages here collect large lists of customers ¶¶ 124, 127, to convey their anecdotes or their financial 15 164, 171, information, including in large tables. Disclosing 179, 229–30; the names would disclose a meaningful customer 16 nn.243–257, list, without meaningfully enhancing the public’s 17 343, 347–50, understanding — which for these portions is 352–55, 357, provided by the underlying facts. GRANTED. 18 365, 440, 447; ¶ 164; figs. 10–11; exhs. 7.1–8.10 19 figs. 10–11; The passages here cumulatively introduce a large exhs. 2.5, set of customers’ names. For reasons like those 20 3.9, 7.1–9.3, above, and because disclosing these names would 21 10; app’x C, reassociate them with year-by-year financial GRANTED- information, redaction is warranted. GRANTED. 22 IN-PART, DENIED-IN- ¶¶ 127, 229–30; nn.365, 440, 447 23 PART. These portions convey anecdotes about customers who are already disclosed and/or whose names 24 appear here in ways that do not convey a large set 25 of customers at once. The basis for redaction as to these names is not persuasive. DENIED. 26 Dkt. No. Dkt. No. Marked n.10 125-12 204-14 redactions in The proposed redaction seeks to obscure a high- 27 (Exh. 5, ¶ 11; n.10; level generalization about how Splunk’s revenues Expert exh. 1; customer. Similar figures were discussed in open | Heinemann app’xs A,B, | court. They help the public understand the case. 2 Supp. Reb. GRANTED- And Splunk failed to mark this same number for Rpt.) IN-PART, redaction in the underlying report to which this 3 DENIED-IN-_ | figure is cited. DENIED. PART. 4 Otherwise 5 Proposed redactions obscure information modeling the change in revenues when Splunk 6 customers become Cribl customers. The highly specific models embed confidential information 7 that would pose needless risks to Splunk if disclosed, given this goes beyond the detail 8 offered in court or needed to understand the case. 9 GRANTED. Dkt. No. Dkt. No. | Green 91,8 10 125-14 204-15 highlighted | Splunk marks for redaction modeling numbers (Exh. 7, portions in that suggest it loses money, but not other 11 Expert 79 1.8: modeling numbers that suggest it gains money Putnam n.9; (compare § 1 (redacting negative percent), with 2 12 Supp. Rpt.) fig. 1, 4 2, 3 (not redacting positive percent)). The DENIED. rationale Splunk asserts for marking the one set would equally apply to the other. And the very 14 detail redacted in one place (¥ 1) is not marked for redaction in another (§ 8). The risks to Splunk are 2 15 not credible. All these high-level numbers inform 16 understanding of the case and were aired in open a court. DENIED.

"7 Fig. 1, n.9 Z 18 These modeling components (or in specific subcategories) of Cribl’s alleged effect on 19 customers’ spending on Splunk was not as distinctly aired in court or dispositive motions. 20 They embed financial information and divulging 21 them would impose needless costs on Splunk given they are beyond the detail needed to 22 understand the case. GRANTED. App’xs No redactions were applied to the figures. 23 A,B,

25 . . it Cribl’s Proposed Redactions. 26 || |Sealed | Public | ResultRe _| Reasoning Dkt. No. Dkt. No. 19:20— Such facts and speculation about Cribl’s 27 125-2 204-2 19:21, profitability and valuation were not “tangentially (Mot.) DENIED. telated to” the case but asserted in arguments 28 about damages (see supra Part 7.A).

20:1–2, This self-serving speculation about Cribl’s future 1 DENIED. profitability is vague, non-committal, and even 2 clichéd. Releasing it cannot credibly hurt Cribl. 20:23–21:1, (See supra Part 7.A.) 3 DENIED. Dkt. No. Dkt. No. ¶¶ 19–21, Similar testimony was heard in open court. This 4 125-4 204-10 DENIED. paragraph and the testimony walked through (Exh. 1, Cribl’s past recuring revenues and Cribl’s 5 Expert percent of customers who were also Splunk’s 6 Putnam customers to sketch damages. And in paragraphs Op. Rpt.) and charts not proposed for redaction, this report 7 again discloses similar recurring revenue numbers and percent of shared customers. 8 ¶¶ 27, 29, (See supra Part 7.A.) 9 DENIED. ¶ 28; n.14, (See ibid.) 10 DENIED. 24 n. 37, Nothing in the cited footnote matches Cribl’s 11 DENIED. rationale or would implicate a third party. After “board The details of private company Cribl’s 12 meeting fundraising and cash position were not disclosed 13 reported” in in open court and have limited relevance to the ¶ 57, dispute. Cribl articulates credible risks that 14 GRANTED. could befall Cribl if disclosed. After “was (See supra Part 7.A.) 15 valued at about” in 16 25 n.48, 17 DENIED. Customer ¶ 106(e) 18 names in Cribl adds nothing to change the decision 55 nn.178– regarding this passage (see supra entry re Dkt. 19 80; Nos. 125-4 & 204-10). DENIED. 20 56 n.18[2]; 58 ¶ 106(e), nn.178–80, 182 21 GRANTED- (See ibid.) GRANTED. IN-PART, 22 DENIED-IN- PART. 23 Customer (See ibid.) 24 name in ¶¶ 142–43, 25 DENIED. Following This is blather about startups, not something 26 “as a meriting sealing (see supra Part 7.A). startup” in 27 ¶ 162, After This valuation of Cribl was disclosed in open 1 “expected court (see supra Part 7.A). 2 profits, at”: 96 n.313, 3 DENIED. ¶ 169, Cribl’s profitability was discussed in open court 4 DENIED. (see supra Part 7.A). ¶ 173, (See previous entry.) 5 DENIED. 6 ¶¶ 180–82, ¶ 180–81 DENIED. Cribl’s revenue over time was discussed in open 7 court, including numbers akin to these figures.

8 ¶ 182 Splunk’s expert estimated Cribl’s incremental 9 profit by multiplying the same figure just 10 discussed by Splunk’s earlier incremental profit margin (not Cribl’s). This is just a high-level 11 estimate that contributed to the damages debate, and it is explained here that way. Cribl’s 12 rationale for redaction is not convincing. 13 ¶¶ 199–200, For similar reasons, these estimates of Cribl’s 202, 204, high-level revenues and profit by Splunk’s expert 14 DENIED. do not pose any credible risk if disclosed. ¶ 213, Cribl’s high-level profitability over time was 15 DENIED. discussed in open court (supra Part 7.A). Financial Exh. 3.1 16 figures in These high-level projections are on the order of 17 exhs. 3.1, those shared in court and are helpful to 3.2, 3.3, understanding the dispute. DENIED. 18 GRANTED- IN-PAT, Otherwise 19 DENIED-IN- These more specific projections for damages 20 PART. under varied scenarios were not discussed as thoroughly in open court, embed more business 21 information with competitive import to Cribl, and ultimately are less important to 22 understanding the dispute. GRANTED. Exh. 3 (See previous entry.) 23 schs. A, B, 24 GRANTED. Exh. 4, (See ibid.) 25 sch. A, GRANTED. 26 Customer These customer names are conveyed in isolated names in anecdotes alongside anodyne information loosely 27 informing the estimates. Cribl has not provided a Exh. 6.1 at sufficiently plausible, specific reason why it 1 lines 2, 21, would be harmed by the names’ release. 2 23; exh. 6.2 at 3 line 17; exh. 6.4 at 4 line 16, DENIED. 5 Customer These exhibits are annex-like tables of all 6 names in customers modeled and all customers shared by exh. 7; Cribl and Splunk. The lengthy lists cumulatively 7 exh. 8, contain significant confidential information that GRANTED. could harm Cribl and its customers if exposed 8 and that is beyond what is needed for public understanding. 9 Financial Private company Cribl’s financial statements 10 statement in were not discussed in detail in open court. Its exh. 9, most recent audited financial statements were 11 GRANTED. disclosed (Dkt. No. 352-31). Nonetheless, these statements contain prior-year information that in 12 connection with current-year information reveals trajectories confidential to Cribl, important to its 13 fundraising prospects, and correspondingly less 14 critical to public understanding of the case. Customer These customer names are denied where 15 names in appearing in isolation and in anecdotes (exh. 10 exh. 10 at at line 7). And they are granted where appearing 16 line 7, in lengthy lists (exh. 15) (cf. supra entry re exhs. 17 DENIED. 6.1, 7). Exh. 15, 18 GRANTED. Fig. 1, Cribl proposes to redact the entirety of the chart 19 DENIED. in Figure 1, but not the entirety of the corresponding table in Schedule A. Further, the 20 only part of the table in Schedule A proposed for 21 redaction was already discussed in open court and is a foothold for understanding damages. 22 Dkt. No. Dkt. No. ¶147, Cribl’s current valuation was discussed in open 125-6 204-11 DENIED. court (supra Part 7.A). 23 (Exh. 2, Financial For reasons like those stated for the same 24 Expert figures in exhibits in Expert Putnam’s opening report, of Putnam exh. 3.1, which these are updates, the redactions are only 25 Reply DENIED. partly granted (cf. supra entry re Dkt. No. 125-4 Rpt.) Exh. 3.2; & 204-10). 26 exh. 3.3 & scheds. A, B; 27 exh. 4 & 1 sched. A, 2 GRANTED. Customer Disclosing these few customer names in such 3 names in isolated anecdotes will not plausibly injure Cribl. exh. 3 4 line 18, 5 DENIED. Dkt. No. Dkt. No. 75:19, Substantially the same Cribl revenue number was 6 125-8 204-12 DENIED. discussed in open court (supra Part 7.A). (Exh. 3, 78:6; The deposed expert discusses some projected 7 Expert 79:7; damages numbers at a high level of generality. Putnam 86:19, Redaction is not warranted (cf. supra entry re 8 Dep. Tr.) DENIED. Dkt. Nos. 125-4 & 204-10 ¶¶ 199–200). 9 130:9; Cribl’s high-level profitability was discussed in 130:16–18; open court and, as this passage helps show, is 10 130:24–25; important to understanding arguments made p. 131 about damages (supra Part 7.A). 11 at ll. 3–4, 8, 13–15; 12 131:17–25; 13 132:1–19; 133:2–5, 14 DENIED. 168:1, Cribl’s revenues as of this exact period were not 15 GRANTED. discussed meaningfully in open court, could harm Cribl if disclosed, and are beyond the detail 16 needed to understand the dispute (cf. supra entry 17 re Dkt. Nos. 125-4 & 204-10 exh. 9). 195:17, These proposed redactions are not warranted for 18 195:24; reasons already stated with respect to the same p. 196 and adjacent redactions in another copy (see 19 at ll. 6, 12, supra entry re Dkt. Nos. 125-8 & 204-12.) 14, 16, 19; 20 197:12; 21 198:14, DENIED. 22 199:23; The number of Cribl’s customers who are also 200:7, Splunk customers was discussed in open court 23 DENIED. (e.g., Tr. 1069). 24 Dkt. No. Dkt. No. ¶¶ 2a, 2b, 2d, ¶ 2a 125-10 204-13 DENIED. Cribl’s high-level profitability over time was 25 (Exh. 4, discussed in open court (supra Part 7.A). Expert 26 Heine- ¶¶ 2b, 2d mann Cribl offered self-serving blather about future 27 performance; it will not credibly be harmed by it Reb. (cf. supra re Dkt. Nos. 125-2 & 204-2 at 20:1–2; 1 Rpt.) see also supra Part 7.A). 2 ¶ 2s, Cribl’s revenues as of this exact period were not GRANTED. discussed in open court and are beyond the level 3 of detail needed to understand the case (cf. supra entry re Dkt. Nos. 125-4 & 2-4-10 exh. 9). 4 ¶¶ 27b, ¶27d, This organizational customer was discussed in 5 DENIED. open court and there is no reason to redact here. ¶ 30, (See supra entry re Dkt. Nos. 125-10 & 204-13 6 GRANTED. ¶ 2s.) 26 n.101, Cribl’s customer was openly discussed in court. 7 DENIED. ¶ 122, Cribl’s proposed redactions target not only a 8 DENIED. purported fact discussed in court but the name of 9 the area of law to which it relates: copyright (see also supra Part 7.A). 10 Customer (See supra entry re Dkt. Nos. 125-10 & 204-13.) names in 11 ¶¶ 124a–c, nn.243–44, 12 GRANTED. 13 Customer (See ibid.) names in 14 ¶¶ 124d–g, nn.245–49, 15 GRANTED. ¶¶ 124h–l, (See ibid.) 16 nn.250–54, 17 GRANTED. ¶¶ 124m–n, (See ibid.) 18 127a; nn.255–57, 19 269, 20 GRANTED. ¶ 171, (See ibid.) 21 GRANTED. Financial Cribl’s revenues as of this exact period were not 22 figures in discussed meaningfully in open court, could pose 82 n.340, risks to Cribl if exposed, and are beyond the 23 GRANTED. detail needed to understand the case (cf. supra 24 entry re Dkt. Nos. 125-4 & 204-10 exh. 9). 83 n.344, Cribl’s customer’s name was discussed in court. 25 DENIED. Customer (See supra entry re Dkt. Nos. 125-10 & 204-13.) 26 names in 27 ¶¶ 179b–e, nn.347–50, Customer (See ibid.) | names in 2 1798, nn.352-5S, 3 GRANTED. 86 0.356, Cribl’s customer’s name was disclosed and 4 DENIED. discussed extensively in relation to testimony 5 that was important to understanding the dispute. 97 n.402, Cribl’s revenues as of this exact period were not 6 GRANTED. discussed meaningfully in open court and are in beyond the level of detail needed to understand 7 the dispute. 111-12 Cribl’s customer’s name chosen for redaction 8 here by Cribl was discussed openly in court. 9 DENIED. There is no particular reason to redact here. Exhs. Private company Cribl’s estimated and actual 10 2.12.4, financial metrics were not discussed with such 3.1-3.10, granularity in open court (nor in other exhibits or 11 4.1-4.9, filings). They are beyond the level of detail 5.15.2; needed to understand the case. For instance, 12 exh. 11 Exhibits 2.1—2.3 estimate revenues at monthly E 43 app’x D, intervals. Exhibit 2.4 provides a line-by-line GRANTED. income statement for many years. Exhibits 4.1— 14 5.2 break down various cost centers, and sources of revenues. Exhibit 11 contains high-level 2 45 financial drivers. Disclosing any of this 16 information could impose costs on Cribl for little = to no relevant gain to public understanding. 17 Customer (See supra entry re Dkt. Nos. 125-10 & 204-13.) lists and Z 18 identifiers m exh. 2.5 19 app’x C, 20 GRANTED. 21 B. SPLUNK’S OPPOSITION TO CRIBL’S MOTION TO EXCLUDE OPINIONS OF EXPERT PUTNAM. 22 i Splunk’s Proposed Redactions. 23 || |Sealed | Public | ResultRe | Reasoning Dkt. No. Dkt. No. | Customer This proof-of-value report was produced by Cribl 24 152-2 179-13 name, to show how much a Splunk customer might save (Exh. 9, DENIED, once it began using Cribl. Its contents were 25 Cribl without examined in open court and adinitted into 6 Executive prejudice evidence (Dkt. No. 352-32). Further risk to Summary to other Splunk, Cribl, or the customer from its additional 27 for redactions release here is speculative — except that some [Redacted], proposed surgical redactions Cribl describes in its motion to 28 infra.

CRIBL_ seal the same document do warrant applying 1 00141373) (infra re Dkt. Nos. 152-2 & 179-13). 2 Dkt. No. Dkt. No. Customer The document is a screenshot or printout of a 152-3 189-15 name in spreadsheet showing Cribl’s estimated cost 3 (Exh. 10, row 1, reduction for a customer using Splunk after Proof-of- DENIED. starting to use Cribl. The customer’s name was 4 Value disclosed in court, including in reference to high- Excel for level discussions of this analysis. And the same 5 [Redacted], document was admitted as an exhibit without 6 CRIBL_ redactions (Dkt. No. 352-38). 0000- Financial In this same sheet is a column showing Splunk’s 7 79497) amounts in itemized prices for varied services. Redactions columns, are proposed in the motion, but none are rendered 8 DENIED. in the public docket. Moreover, the same document was admitted without redactions as a 9 trial exhibit (Dkt. No. 352-38). 10 Dkt. No. Dkt. No. Customer The third party is noted elsewhere, but not with 152-4 189-16 name in respect to these financial details. Redaction of the 11 (Exh. 11, row 1, third-party name is warranted to protect its Proof-of- GRANTED. confidences and Splunk’s interests related to them 12 Value (or Cribl’s, as it supports infra). 13 Excel for Financial Redactions are proposed in the motion, but none [Redacted], amounts in are rendered in the public docket. Given that 14 CRIBL_ columns, similar information was disclosed in the trial 00619088) DENIED. exhibit above, that the numbers are not fresh, and 15 that Splunk’s lack of attention to these filings undermines its contention that it has any cause to 16 seal, the redactions are not warranted. 17 Dkt. No. Dkt. No. Customer Redactions are warranted for the reasons 152-5 189-17 name in described for an analogous entry above (cf. 18 (Exh. 12, row 2, previous entry). TCO & GRANTED. 19 ROI Financial Redactions are proposed but none are provided in Calculator amounts in the published copy. Redactions are not warranted 20 for columns, (cf. ibid.). 21 [Redacted] DENIED. CRIBL_00 22 072967)

23 Dkt. No. Dkt. No. Customer This is another proof-of-value report produced by 24 152-7 189-19 name in all Cribl to show how much a Splunk customer might (Exh. 14, headers, and save once using Cribl. A closely related report 25 CRIBL_ in pp. -81, was discussed in open court and moved into 0073781) -82, -96, evidence. Moreover, some instances of the 26 DENIED. customer’s name here are not redacted. Splunk’s rationale for redacting is thus undermined (cf. 27 supra entry re Dkt. Nos. 152-2 & 179-13). Dkt. No. Dkt. No. Customer This document contains extensive notes from 1 152-14 179-15 name in pp. three customer interviews to learn about their use 2 (Exh. 21, -185–86, of Cribl and Splunk and the interaction between CRIBL_ GRANTED. the two services. Disclosing any name here 3 00146171) would associate the customer with specific service details and impose needless risks on that 4 third party and thereby Splunk (and Cribl, infra), while redacting just the name does not detract 5 from public understanding. 6 Splunk In the context of these reports, some customers pricing in talk about the price they say they paid for Splunk 7 pp. -186– or Cribl (just as it turns out some have done on 87, Splunk’s support pages on its website). Only 8 DENIED. Splunk proposes to redact what these customers themselves chose to say about past pricing. But 9 even Splunk does not flag every page such 10 discussions come up, and in the publicly filed copy no redactions on page -87 are rendered. 11 Splunk’s fears are not credible. Dkt. No. Dkt. No. Customer The customer was not discussed meaningfully in 12 152-18 189-27 name in open court, yet here appears alongside a generic (Exh. 26, 88:1, 88:5, needs and cost-savings discussion, now two years 13 Heudecker 88:17, old. Splunk provides no sufficiently specific 14 Dep. Tr.) DENIED. rationale for redaction. Dkt. No. Dkt. No. Customer This is another proof-of-value report produced by 15 152-21 189-30 names in Cribl and containing a customer name with (Exh. 29, p. 1, pricing information from Splunk (and Cribl). For 16 “Proof-of- cells B1–C1; reasons like those given for the other such reports 17 Value” p. 2, cell H1; above, redaction is warranted here, too (see supra Slides for p. 4, cell entry re Dkt. Nos. 152-4 & 189-16). 18 [Redacted], B1, CRIBL_ GRANTED. 19 00079545) Financial Redactions were proposed but not rendered on the amounts in public docket. For reasons like the ones given for 20 columns, the other such reports above, redaction is not 21 DENIED. warranted here (see ibid.). Dkt. No. Dkt. No. Customer The same result obtains for the same reasons 22 152-22 189-31 name in articulated in an analogous entry (see ibid.). (Exh. 30, row 1, 23 “Proof-of- GRANTED. 24 Value” Financial (See ibid.) Slides for amounts in 25 [Redacted], columns, CRIBL_ DENIED. 26 0007751)

27 ii Cribl’s Proposed Redactions. 1 || [Sealed [Public | ResultRe | Reasoning > Dkt. No. Dkt. No. These characterizations of Cribl’s valuation and 152-1 189-62 DENIED. profitability were openly discussed (supra Part 3 (Opp.) 7A). p. 4 at lines This “instructive” proof-of-value analysis about 4 19, 22, 25-28 | a customer was also introduced in open court. p. 5 at lines 3, | Redacting the name of that customer is not 5 8, 10, 13-14, | warranted here, either (see, e.g., supra re Dkt. 6 DENIED. Nos. 152-3 & 179-13). 14:6; These characterizations of Cribl’s valuation and 7 14:8-11; profitability were discussed openly (supra Part 14:25; 7.A). 8 20:22: 9 21:5, DENIED. 10 (See ibid.) 17:11-12, 11 DENIED. Dkt. No. Dkt. No. Customer The document is the proof-of-value summary 12 152-2 179-13 name in provided for a customer discussed in court and (Exh. 9, PDF pp. adinitted as an exhibit (Dkt. No. 352-32). = Cribl 2-3, 4-5,11, | Redactions as to the customer name in this copy 14 Executive 16, 19-24, are denied for the same reasons (see supra entry Summary 27-29, 34, te Dkt. Nos. 152-2 & 179-13: see also entry re 15 for DENIED. Dkt. Nos. 169-2 & 170-2). DENIED. 16 [Redacted], Other names | Cribl also seeks to redact the third party’s CRIBL _ (e.g. employee’s names and some operational 17 00141373) employees) information. This information was already PDF pp. 7—10, | published in the admitted exhibit; there is no Z 18 12-15, 17, personally sensitive information here. 21-22, 19 24-25, 0 DENIED. Code in Fragments of code included in this presentation 2] PDF pp. 21—_| are peripheral to the purpose for which this 22, 32, 34-35, | presentation was discussed in court. They were 22 GRANTED. not themselves disclosed in court and beyond the level needed to understand the dispute or judicial 23 process. Nor were they legible in the copy 24 submitted for trial (Dkt. No. 352-32). Disclosing them creates risks for the third party and Cribl 5 without adding to relevant public understanding. Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 152-3 & 189-15.) 26 152-3 189-15 name in (Exh. 10, -9497 (row 1), 27 Proof-of- DENIED. 28 Value

Excel for 1 [Redacted], 2 CRIBL_ 0000- 3 79497) Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 152-4 & 189-16.) 4 152-4 189-16 name in (Exh. 11, -9088 (row 1), 5 Proof-of- GRANTED. 6 Value Excel for 7 [Redacted], CRIBL_ 8 00619088)) Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 152-5 & 189-17.) 9 152-5 189-17 name in PDF 10 (Exh. 12, pp. 2 (row 2), TCO & 5 (row 1), 11 ROI GRANTED. Calculator 12 for [Redacted] 13 CRIBL_00 14 072967) Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 152-7 & 189-19.) 15 152-7 189-19 name in (Exh. 14, headers, 16 CRIBL_ pp. -81–97 17 0073781) DENIED. Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 152-14 & 179-15.) 18 152-14 179-15 name in (Exh. 21, (Exh. 21) -185–86, 19 CRIBL_ GRANTED. 00146171) 20 Dkt. No. Dkt. No. Company This testimony about Cribl’s valuation as of this 21 152-17 179-16 valuation in date was given in open court (supra Part 7.A). (Exh. 25, 318:22, 22 Sharp Dep. DENIED. Tr. Ownership This testimony about an individual’s personal 23 Excerpt) percents in ownership interest in Cribl is ultimately 24 318:24, peripheral to the litigation; repeating it offends GRANTED. personal privacy and serves no public purpose. 25 Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 152-18 & 189-27.) 152-18 189-27 name in 26 (Exh. 26, 88:1, 88:5, Heudecker 88:17, 27 Dep. Tr.) DENIED. Dkt. No. Dkt. No. Customer This marketing presentation with presenter notes | 152-20 189-29 names in describes Cribl and its benefits. Within the notes 2 (Exh. 28, PDF pp. are some customer names as reminders of use “Cribl 18-19, cases. Several of those customers and their use 3 Overview,” DENIED. cases are still touted on Cribl’s website today. CRIBL_ 4 00598104 5 Dkt. No. Dkt. No. Customer (See supra re Dkt. Nos. 152-21 & 189-30.) 152-21 189-30 name in PDF 6 (Exh. 29, Pages 2-3, 5, “Proof-of- GRANTED. 7 Value” Slides for 8 [Redacted], 9 CRIBL_ 00079545 10 Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 152-22 & 189-31.) 152-22 189-31 name i 11 (Exh. 30, -7551, “Proof-of- GRANTED. Value” for S 23 [Redacted], CRIBL_ 14 0007751 45 C. CRIBL’S REPLY □□ SUPPORT OF ITs Motion To EXCLUDE OPINIONS OF EXPERT PUTNAM. 16 = i Splunk’s Proposed Redactions. 17 || |Sealed | Public | ResultRe [Reasoning Dkt. No. Dkt. No. | Customer 4:23, 5:12 18 169-1 170 name in The passage describes and cites to a proof-of- 19 (Reply) 4:14—23, value analysis. The proposed redactions would 5:12, 5:22— | obscure the beneficiary’s name. Doing so is 20 6:5, warranted for reasons like those given for GRANTED- redacting the names in proof-of-value analyses 21 IN-PART, elsewhere (see, e.g., supra entry re Dkt. Nos. 152- DENIED-IN-_ | 22 & 189-31; infra re Dkt. Nos. 169-1 & 170 PaRT. (Cribl’s rationale)). GRANTED. 23 Otherwise 24 These passages describe another such analysis. But that analysis and customer were discussed in 25 open court, with the analysis itself admitted as an 6 exhibit not under seal (Dkt. No. 352-32). DENIED. 7 Dkt. No. Dkt. No. | Customer The document cited is again the proof-of-value 28 xh. 31, exhibit (Dkt. No. 352-32). Redactions as to this

Cribl DENIED, copy are denied for the same reasons — except | Executive without that some surgical redactions Cribl describes in its 2 Summary: prejudice motion to seal may be warranted (infra entry re [Redacted]) to Dkt. Nos. 169-2 & 170-2). 3 redactions discussed 4 infra. Dkt. No. Dkt. No. | Customer (See supra entry re Dkt. Nos. 152-21 & 189-30.) 5 . 169-3 170-3 name in “Proof-of- | sheet); cf | GRANTED. 7 Value” Dkt. No. | Financial (See ibid.) Slides for | 189-30 amounts in 8 [Redacted], columns, 9 CRIBL _ DENIED. 00079545 10 . . il Cribl’s Proposed Redactions. 11 || [Sealed Public | ResultRe __| Reasoning Dkt. No. Dkt. No. 4-6 (§ 1.A), For the reasons and to the extent discussed above 12 169-1 170 GRANTED-IN- | with respect to Splunk’s motion to seal, the E B (Reply) PaRT, redactions are granted in part (see supra entry re DENIED-IN- Dkt. Nos. 169-1 & 170). 14 PART. Dkt. No. Dkt. No. Customer Cribl adds no reason to reach a different result 2 15 169-2 170-2 name at PDF | (see supra entry re Dkt. Nos. 169-2 & 170-2). (Exh. 31, pp. 2-3, 4-5, 16 Cribl 11, 16, 19-24, Executive 27-29, 34, 617 Summary DENIED. 18 for Other names | (See supra entry re Dkt. Nos. 152-2 & 179-13.) [Redacted], (e.g. 19 CRIBL _ customer 00141373) employees) at 20 PDF pp. 7-10, 21 12-15, 17, 21-22, 24-25, 27 DENIED. Code at (See ibid.) 23 PDF Page [14-15, 22, 24 25, 27-28], 25 GRANTED. Dkt. No. Dkt. No. Customer (See supra entry re Dkt. Nos. 169-3 & 170-3.) 26 169-3 170-3 name, (Exh. 32 (slip- GRANTED. 27 “Proof-of- | sheet) Otherwise, 28 Value” DENIED.

1 Slides for [Redacted], 2 CRIBL_ 00079545 3 Dkt. No. Dkt. No. Entirety, The exhibit is a recorded video meeting between 169-4 170-4 GRANTED. a Cribl representative and a Splunk customer, 4 (Exh. 33, (slip- describing Splunk’s costs and potential savings 5 Video File) | sheet) achieved through Cribl. The substance important to the case is already conveyed through other 6 filings and written reports (see, e.g., Dkt. Nos. 169-1 & 170). This format includes more private 7 details about a third-party business, and images and audio of third-party individuals. Sealing is 8 warranted to protect their privacy and so Cribl. 9 8. MOTIONS TO SEAL STEMMING FROM SPLUNK’S MOTION IN 10 LIMINE No. 2 RE THIRD-PARTY S2S INTEGRATIONS. 11 Splunk moved to preclude third-party integrations from argument and evidence (Dkt. No. 12 200). Cribl opposed (see Dkt. No. 201). Splunk also moved to seal its materials in these files

13 (Dkt. No. 201), and to consider whether Cribl’s and a third party’s materials should be sealed

14 (Dkt. No. 202). Cribl timely submitted a supporting declaration (Dkt. No. 241). So did the

2 15 third party, Confluent (Dkt. Nos. 237, 238). This order rules as follows:

a 16 A, SPLUNK’S MOTION IN LIMINE No. 2.

= 17 i Splunk’s Proposed Redactions. 1g || [Sealed | Public | ResultRe | Reasoning Dkt. No. Dkt. No. Green (See supra entry re Dkt. Nos. 129-2 & 179-9 19 201-1 at 45 | 200 at 45 | highlighted {| 177-80.) (Exh. 2, code in 20 Excerpts of 177- Expert 180], Astrachan GRANTED- 22 Op. Rpt.) IN-PART, DENIED-IN- 23 PART. Dkt. No. Dkt. No. Purple As has occurred elsewhere, Splunk provides a 24 201-1 at 64 | 200 at 64 =| highlighted single rationale for justifying every customer 5 (Exh. 3, customer name in this lengthy, single-spaced document, Cribl Tr., names, and does not provide any page numbers on 6 CRIBL _ DENIED. which to find them. That conduct belies 00072913) Splunk’s interest in sealing the names (see a/so 27 supra re Dkt. Nos. 125-6 & 204-11). 28

Dkt. No. Dkt. No. Purple This short deposition transcript peripherally | 201-1 200 at 159 | highlighted contains the name of a customer alongside one 2 at 159 customer detail of its technical setup. The proposed (Exh. 12, names in redactions target the customer’s name. But the 3 Agepati [52:4, same customer and detail is already disclosed in Dep. Tr.) 52:8, an email admitted as a trial exhibit (Dkt. No. 4 52:25], 352-79). DENIED. 5 6 it Cribl’s Proposed Redactions. |Sealed | Public __| ResultRe _| Reasoning 7 Dkt. No. Dkt. No. Customer (See supra entries re Dkt. Nos. 153-2 & 189-47 202-2 at 45 | 200 | names in 4] 126-27, and Dkt. Nos. 148-13 & 167-14). 8 (Exh. 2, 9 126-27, Excerpts of DENIED. 9 Expert 10 Astrachan Op. Rpt. 11 Dkt. No. Dkt. No. Customer The passage transcribes a meeting. Some 202-2 at 64 | 200 at 64 =| names in customer names are mentioned together at its 12 (Exh. 3, 88, conclusion, and those names are identified for E B Cnibl Tr., DENIED. redaction. But there is nothing disclosed in CRIBL _ conjunction with the names to suggest that 44 00072913) disclosure could in any way injure the third parties and thereby Cribl upon disclosure (see 2 15 also supra entry re Dkt. Nos. 201-1 & 200 at 64). Dkt. No. Dkt. No. Customer (See id. at 159.) 16 202-2 200 at 159 | names in at 159 52:4, 52:8, (Exh. 12, 52:25, 18 Agepati DENIED. Dep. Tr. 19 iii Confluent’s Proposed Redactions. 20 || Sealed | Public | ResultRe _| Reasoning Dkt. No. Dkt. No. Confluent’s Confluent is not a party to this litigation. 21 202-2 at 237-3 proposed Confluent commercializes open-source software 22 166 redactions projects, and in one instance reverse-engineered (Exh. B: on Dkt. No. Splunk’s S28 protocol (see, e.g., Tr. 380, Tr. 23 Exh. 13 of 237-3, 788-790, 875-86, 883). Testimony was offered Splunk’s DENIED. that Cribl reverse-engineered the S2S protocol 24 Mot. in partly by reviewing Confluent’s handiwork. 95 Limine No. This document is an email that contains 2: Email Confluent’s rough-draft plan for an engineering 26 fr. Agepat, project related to Splunk’s S2S. Confluent at CON- first proposed to redact nearly its entirety (see 27 00000001- Dkt. No. 237-2). Since then — after the lead-up 09) to trial and the testimony above, and with parties 28 having been ordered to inform Confluent before

using Confluent’s confidential source code at | trial (Dkt. No. 122) — the same file was 2 admitted as an exhibit at trial (Dkt. No. 352-3). That exhibit lacks proposed redactions. 3 Moreover, Splunk’s and Cribl’s disclosures of related information suggest that, if there ever 4 was value to this high-level information, there is 5 less now. Cf Camilla A. Hrdy & Mark A. Lemley, Abandoning Trade Secrets, 73 STAN. L. 6 Rev. 1, 1 (2021). There is no cause to redact. Dkt. No. Dkt. No. Confluent’s This document is a closer-to-final or final 7 202-2 at 237-2 proposed version of the same plan. It contains the same 153 redactions elements disclosed above but some details, 8 (Exh. A: on Dkt. No. including personnel and coding information. 9 Exh. 11 of 237-2, That information has some commercial import, Splunk’s GRANTED- partly from being undisclosed. Because the 10 Mot. in IN-PART, information about the third party and protocol Limine No. DENIED-IN- that is relevant to the public’s understanding is 11 2: Eng’g Part. already disclosed, redaction of the undisclosed 1-Pager: details is warranted as follows: 12 Splunk e Column to right of “Target Release,” S 13 S2S Source “Epic,” “Status,” “Review Deadline,” = Connector, “Stakeholders,” and “Technical Y 14 CON- Reviewers” in -73 GRANTED. 9 00003073- e Remainder of sentence after “This 2 15 77) builds on the work” in -73, GRANTED. e Diagrams in -74 and -75, GRANTED. 16 □ Otherwise, DENIED. 17 B. CRIBL’S OPPOSITION TO SPLUNK’S MOTION IN LIMINE No. 2. Z 418 . . i Splunk’s Proposed Redactions. 19 || [Sealed | Public | ResultRe _| Reasoning Dkt. No. Dkt. No. Green (See supra entry re Dkt. Nos. 148-18 & 167-19.) 20 201-1 200 at 214 | highlighted at 214 code details (Exh. 2, in [FF 99, 22 Expert 101, fig.19, Mitzen- n.129], 23 macher GRANTED- Reb. Rpt.) IN-PART, 24 DENIED-IN- 5 PART. Dkt. No. Dkt. No. Green This information was disclosed publicly (see, 6 201-1 at 200 at 221 | highlighted e.g., Dkt. No. 189-69 § 239; Dkt. No. 167-38 at 221 (Exh. code details 20; Dkt. No. 167-3 at 108 n.204). Again, the 27 3, Excerpts in [§ 239], inconsistent application of redactions negates the 38 of Expert DENIED. purported reasons for redaction (supra Part 3.A).

1 Op. Rpt. 2 Dkt. No. Dkt. No. Green First, Splunk provides one rationale for every 201-1 at 200 at 331 | highlighted snippet of code in this 51-page document. 3 331 (Exh. code, Splunk does not cite to any page number, line, or 11, DENIED. footnote to find those snippets. Given that the 4 Excerpts of Court warned parties to identify passages at pain 5 Cribl’s 3d of summary rejection (see Dkt. No. 141), this Supp. to conduct itself suggests lack of cause to seal. 6 Splunk’s Second, the proposed redactions identified by 4th this order (one hopes the only ones within the 7 Interrogs.) document) do not seek to protect specific things that are not already public. Splunk, for instance, 8 proposes to redact a relevant code phrase where 9 even when it appears in Splunk’s public-facing web addresses (URLs). Yet Splunk does not 10 propose redacting other URLs that point to Splunk’s own or third-party websites that □□□□□ 11 contain the phrase. Redactions are not warranted see also supra Part 3.A). 12 Dkt. No. Dkt. No. Purple The cited document was already published S 23 201-1 at 200 at 383 | highlighted without redactions (Dkt. No. 200 at 383). 383 (Exh. customer 14 12, Ltr. names 9 Jacobs to DENIED. 15 Cribl, 2 CRIBL_ 16 00138503 17 Dkt. No. Dkt. No. 115:4-6 The single customer name that is proposed for 201-1 at 200 at 412 | DENIED. redaction is also named on Splunk’s website. Z 418 419 (Exh. 15, Eber 19 Dep. Tr.) 20 ii, Cribl’s Proposed Redactions. 21 |) [Sealed | Public | ResultRe _| Reasoning Dkt. No. Dkt. No. Highlighted The redaction obscures the home address of a 22 202-2 at 200 at 188 | personally deponent. To prevent annoyance or abuse to the 3 188 identifiable third party and so injury to Cribl, redaction is (Exh. 1, information readily warranted. Bonecco at 8:24— Dep. Tr.) 8:25, 25 GRANTED. 6 Dkt. No. Dkt. No. Highlighted n.356 202-2 at 200 at 388 | customer This footnote was not requested for redaction in 27 388 names in other copies of this excerpt, and a third-party (Exh. 13, 86 0.356, name to be redacted here was discussed in court. 28 Excerpts 86 0.357, DENIED.

1 of Expert GRANTED- Heine- IN-PART, n.357 2 mann DENIED-IN- (See supra entry re Dkt. Nos. 125-10 & 204-13.) Reb. PaRT. GRANTED. 3 Rpt. 4 5 9. MOTIONS TO SEAL STEMMING FROM CRIBL’S TRIAL BRIEF AND MOTIONS IN LIMINE. 6 Crib] filed a trial brief (Dkt. No. 207; see also Dkt. Nos. 232, 235 (removing incorrect 7 filings)). Cribl also filed three motions in limine (Dkt. Nos. 210-12). Cribl simultaneously 8 moved to seal its materials therem (Dkt. No. 208), and those of another (Dkt. No. 209). Splunk 9 timely submitted a supporting declaration (Dkt. No. 230; see also Dkt. Nos. 240, 244 10 (removing incorrect filings)). i A, CRIBL’S TRIAL BRIEF. 12 The public copy of Cribl’s trial brief was removed (Dkt. Nos. 240, 244), but not replaced.

13 Redactions marked in the sealed copy and proposed in motions are without merit in any case.

i Splunk’s Proposed Redactions. 15 || [Sealed | Public | ResultRe | Reasoning Dkt.No. | Dkt.No. | 21:8,21:17, | The proposed redactions target code elements Qa 16 209-4 209-3. 21:23-24, already publicly disclosed (see supra Part 3.A). (Br.) But see 22:2-4, 17 Dkt. No. | DENIED. o 18 244. 19 it Cribl’s Proposed Redactions. |Sealed | Public _| Result Re___| Reasoning 20 Dkt. No. Dkt. No. | 26:2, 26:4, Cribl’s overall profitability and top-line revenue 208-4 208-3. DENIED. were discussed in open court (see supra Part 7.A). 21 (Br.) But see Dkt. No. 22 244. 23 B. CRIBL’S MOTION IN LIMINE No. 1. 24 Only Splunk provided redactions here. »5 || [Sealed [Public [Result Re | Reasoning Dkt. No. Dkt. No. 243:12, The proposed redaction targets code elements 26 209-10 209-09 DENIED. already publicly disclosed (see supra Part 3.A). (Cribl’s 27 MIL No. 28 1, Exh.

1 4, Excerpts 2 of Expert Mitzen- 3 macher Dep. Tr. 4 C. SPLUNK’S OPPOSITION TO CRIBL’S MOTION IN LIMINE 5 No. 1. 6 Again, only Splunk proposes redactions. || [Sealed | Public ResultRe _| Reasoning Dkt. No. Dkt. No. | Highlights The proposed redaction targets elements of the 8 209-6 209-5 in 26-31 S28 protocol and its implementation, some of (Pearson 79, 81- which are already known, and some of which are 9 Exh. 4, 86 (figures not. For reasons already described with respect to Excerpts only)], the same underlying report, the proposed 10 of Expert GRANTED- redactions are granted-in-part and denied-in-part Astrachan IN-PART, (see supra entry re Dkt. Nos. 148-13 & 167-14; Op. Rpt.) DENIED-IN-__| see also Part 3.A). 12 PaRT.

& 13 D. CRIBL’S MOTION IN LIMINE No. 2 5 14 Only Splunk proposes redactions. Sealed Public | ResultRe | Reasoning 2 15 (Cribl’s Dkt. No. | Personal The proposed redactions obscure personal contact □□□ □□□ | 211 at info. at details for witnesses. Disclosure would make a 16 2, Exh. 70 [1-2], possible annoyances or abuse, and serve no public 7 3, Rule GRANTED. | purpose. 26(a)(3) 7 18 Discl. 19 20 E. SPLUNK’S OPPOSITION TO CRIBL’S MOTION IN LIMINE No. 3. 21 (i) Splunk’s Proposed Redactions. 22 Splunk ultimately did not provide support for these proposed redactions (see Dkt. No. 23 230-1 at 1). If even desired, they are DENIED, without prejudice to Cribl’s proposals. 24 it Cribl’s Proposed Redactions. 25 || [Sealed Public | ResultRe | Reasoning Dkt. No. Dkt. Customer (See supra entry re Dkt. Nos. 148-25 & 167-26.) 26 208-6 No. names in (Exh. 13, | 208-5 -6584-85, 27 “Take DENIED. 28 Home

Idea,” | CRIBL_0 2 0856585 Dkt. No. Dkt. No. | Highlighted | (See supra entry re Dkt. Nos. 134-19 & 189-45.) 3 208-8 208-7 portions at: (Exh. 14, 6:17-18, 4 Cribl’s 6:21: 5 7th Supp. 16:9-10, Resp. to 16:13-14; 6 Splunk’s 25:11-12, 2d 25:15, 7 Interrog.) 25:17; 27:4, 27:12; 8 28:19, 31:9, 9 GRANTED. 10 10. MOTION TO SEAL STEMMING FROM JOINT PROPOSED FINAL PRETRIAL ORDER. 1 Splunk filed the joint proposed final pretrial order (Dkt. No. 197). Splunk 12 contemporaneously moved to consider whether Cribl’s material within its appendices should

= 13 be sealed (Dkt. No. 203). Cribl timely submitted a supporting declaration (Dkt. No. 242). This 14 order rules as follows: 15 || [Sealed | Public | ResultRe | Reasoning Dkt. No. Cf. Customer Pages not flagged in motion (e.g., 1, 102-36) Aa 16 203-2 Dkt. No. names in For avoidance of doubt, any marked redactions (App’x A, | 303 blue-colored | not matched with a rationale in the motion are 17 Joint font at: denied (see Dkt. No. 141). DENIED. 18 Combined 24, 9-14, Exhibit 16, 18-20, Redactions after “FY20” (p. 74-75) 19 List) 22, 53-58, The redaction is not customer information, and 61-69, 73- no other rationale is provided. DENIED. 20 74, 77-80, 82-83, 87, Redactions after “Specialist at” (pp. 4, 14) 21 89, 91-92, This customer was discussed in court, and 2 94-95, 97, nothing here merits redaction specially. DENIED. 101, 93 GRANTED- Otherwise IN-PART, Some of these customer names were disclosed 24 DENIED-IN-__| elsewhere. But disclosing them in this appendix Part. still risks injury to the third parties and to Cribl, 25 given many names appear alongside file names 26 pointing to more private information, and given they appear together. And disclosing such 27 names here is less important to public understanding of the merits, as the reading and 28

1 analysis of factual or legal points are not interrupted or obscured. GRANTED. 2 Dkt. No. Cf Contact The highlighted pottions are all personal contact 203-3 Dkt. No. details in details with little-to-no relevance to the dispute. 3 (App’x C, | 303 2:12-14; Redaction is warranted to avoid risk of Joint 2:21-21; annoyance or abuse from disclosure (and so of 4 Combined 2:22; harm to Cribl). 5 Exhibit 3:12; 3:3: List) 3:10-11; 6 3:12: 3:19- 22; 3:23: 7 4:13-14; 4:21-22:; 8 4:23: 4:28: 9 5:12; 5:3: 5:9-10: 10 5:10; 5:24— 25; 5:26; 1] 6:45: 6:6; 6:28 7:1; 12 7:3, & 13 GRANTED. 11. MOTION TO SEAL STEMMING FROM CRIBL’S TRIAL BRIEF RE 15 OBJECTIONS TO SPLUNK’S DISCLOSURE OF LIVE WITNESSES.

Q 16 Cribl filed a trial brief with objections to a Splunk disclosure of live witnesses (Dkt. No.

= 17 252). Cribl contemporaneously moved to consider whether another’s material therein should 6 Z 18 be sealed (Dkt. No. 251). Splunk timely submitted a supporting declaration (Dkt. No. 261). 19 This order rules as follows: || [Sealed___| Public | Result Re | Reasoning Dkt. No. Dkt. No. | 2:13, 2:16, Proposed redactions obscure employee names and 2] 251-4 251-3 GRANTED. contact information, and are warranted to avoid (Nina annoyance or abuse and because these details are of 22 Exh. C little or no help to understanding the case. 73 Dkt. No. Dkt. No. | 2:13, 2:16, (See previous entry.) 251-6 251-5 GRANTED.

12. MOTION TO SEAL STEMMING FROM SPLUNK’S TRIAL BRIEF RE 25 TESTIMONY OF [ACOBELLI. 26 Splunk filed a trial brief (Dkt. No. 271), and moved to seal it (Dkt. No. 272). This order 27 tules as follows: 28

|Sealed | Public__| Result Re _| Reasoning Dkt. No. Dkt. No. | Highlights The transcript in passing mentions a few customer 2 272-1 273-2 [302:21: names. Though some appear alongside files, the (Exh. 2, 303:19, files appear to be of no consequence; one is six 3 Tacobelli 303:23], years old. There is no harm that could come to the Dep. Tr. DENIED. third parties nor to Splunk by disclosure. 4 Dkt. No. Dkt. No. | Highlights, (See supra entry re Dkt. Nos. 134-19 & 189-45.) 5 272-2 273-3 GRANTED- (Exh. 3, IN-PART, 6 Cribl’s DENIED-IN- 7th PART. 7 Supp. Resp. to 8 Splunk’s 9 2d Interrog. 10 o. 5 11 13. MOTION TO SEAL STEMMING FROM SPLUNK’S TRIAL BRIEF RE 12 CRIBL’s RESPONSES TO SPLUNK’S INTERROGATORY NO. 5. & 13 Splunk filed another trial brief (Dkt. No. 281), and moved to seal it (Dkt. No. 280). This

14 order rules as follows: || [Sealed [Public | Result Re | Reasoning Dkt. No. Dkt. No. | Green (See previous entry.) A 16 280-1 281-2 highlights, (Exh. 1 GRANTED- 17 Cribl’s IN-PART, 5 7th DENIED-IN- Zz 18 Supp. PART. Resp. to 19 Splunk’s 20 2d Interrog. 21 0. 5 22 14. MOorTIoN To SEAL STEMMING FROM TRIAL EXHIBITS. 23 Splunk moved to seal trial exhibits (Dkt. No. 298). This order rules as follows: |Sealed | Public _| Result Re __| Reasoning 24 (In- 352-4 All but The first page outlines the remaining pages, 25 Chambers | (TX-5) p- 1, surveying the elements of the protocol and its Copy) GRANTED. | implementation familiar to the case (supra Part 26 3.A.) The remainder of the document describes details that are not disclosed or not so completely 27 and compactly disclosed elsewhere. Disclosing 28 them in such actionable form could cause

commercial harm to Splunk. These details are | beyond what is required to understand the dispute 2 or judicial process. Redaction is warranted. (In- 352-14 Entirety, This document presents the findings of Cribl’s 3 Chambers | (TX-45) | GRANTED project to reverse engineer the S2S v4 protocol and Copy) -IN-PART, | its implementation in Splunk Enterprise. Splunk 4 DENIED- proposes redacting the entirety. But the previous 5 IN-PART. entry provided an unredacted overview of the top- level outline of that document. The following 6 granted redactions will obscure anything meriting sealing while permitting the public to see the 7 document’s outline and how it fits into the litigation: 8 e On page 1, from top of the page to “Setup:” 9 DENIED: e On page 2, “Header/Preamble” DENIED; 10 e On page 4, “One... Splunk 2” DENIED; e □□ page 7, “Metrics” DENIED; VW e On page 7, “OpCodes:” DENIED; 12 e On page 7, “Misc notes:” DENIED: e On page 19, “Errors . . . implementation” € 13 DENIED. Otherwise, GRANTED. 14 (In- 352-25 All but The same reasoning applies to this analogous B15 Chambers | (TX-108) | p. 1, document as already described above (see supra Cop GRANTED. _| entry re Dkt. No. 352-4. a 16 (In- 352-39 All but (See ibid.) 17 Cop GRANTED. Oo Z 418 15. MOTION TO SEAL STEMMING FROM JOINT AMENDED TRIAL 19 Exuisit List. 20 Splunk filed a joint amended trial exhibit list (Dkt. No. 303), and moved to consider 21 whether to seal another’s materials therein (Dkt. No. 302). Cribl timely submitted a supporting 22 declaration (Dkt. No. 340). This order rules as follows: 53 || [Sealed | Public | ResultRe | Reasoning Dkt. No. Dkt. No. | Customer names in For the same reasons and only to the 4 302-2 303 24, 9-14, 16, 18— same extent as before, redactions are (Joint 20, 22, 53-58, 61-69, | granted-in-part and denied-in-part (see 25 Amd. 73-74, 77-80, 82-83, | supra entry re Dkt. No. 203-2). Exh. 87, 89, 91-92, 94-95, 26 List) 97, 101, GRANTED-IN-PART, DENIED-IN-PART. 28

1 CONCLUSION 2 The administrative motions to seal are GRANTED IN PART and DENIED IN PART. Parties 3 shall refile all relevant documents in full compliance with this order by no later than 4 SEPTEMBER 30, 2024. The district court retains jurisdiction to ensure compliance with this 5 order (see also Dkt. No. 69 ¥ 8). 6 IT IS SO ORDERED. 7 8 Dated: August 19, 2024. Pee 9 {Acs EA oe 10 LLIAM ALSUP UNITED STATES DISTRICT JUDGE 1]

13 «4 o

16 Z 18 19 20 21 22 23 24 25 26 27 28