Splunk Inc. v. Cribl, Inc. et al, No. 3:2022cv07611 - Document 74 (N.D. Cal. 2023)
Court Description: ORDER DENYING 59 MOTION FOR LEAVE TO AMEND. SIGNED BY JUDGE ALSUP. (whalc2, COURT STAFF) (Filed on 6/23/2023)
Download PDF
<![CDATA[
1 2 3 4 5 UNITED STATES DISTRICT COURT 6 7 NORTHERN DISTRICT OF CALIFORNIA 8 9 10 SPLUNK INC., Plaintiff, United States District Court Northern District of California 11 12 13 14 No. C 22-07611 WHA v. CRIBL, INC. and CLINT SHARP, ORDER DENYING MOTION FOR LEAVE TO AMEND Defendants. 15 INTRODUCTION 16 17 Following the order granting in part and denying in part defendants’ motion to dismiss, 18 plaintiff moves for leave to file an amended complaint. For the reasons stated herein, 19 plaintiff’s motion is DENIED. STATEMENT 20 21 22 23 The order on the motion to dismiss described the purported facts at issue (Dkt. No. 55 at 1–3). Briefly, they are as follows. Patent and copyright owner Splunk Inc. was founded in 2003 and runs a platform for 24 analyzing large volumes of data. Its flagship product, Splunk Enterprise, ingests flows of data 25 from disparate sources and indexes that data, allowing customers to interact with and monitor 26 their data in real time. Through its Technology Alliance Partner (“TAP”) program, Splunk 27 grants partners a license to use its software development tools and a limited license to run 28 Splunk Enterprise (Compl. ¶¶ 1, 17, 25). 1 2 including alleged infringer and Cribl CEO Clint Sharp. In 2018, Cribl launched its first 3 product, now known as Stream, and joined the TAP program by entering into a TAP agreement 4 with Splunk. In 2021, Splunk terminated Cribl’s membership in the TAP program and their 5 TAP agreement. Roughly one year later, it filed a complaint against Cribl and CEO Sharp in 6 the District of Delaware. After Cribl and CEO Sharp indicated that they intended to raise 7 challenges related to personal jurisdiction and venue, the parties agreed that Splunk would 8 voluntarily dismiss its complaint and refile in the Northern District of California (Compl. ¶¶ 2, 9 38–39, 67; Br. 2, Exhs. S–T). 10 United States District Court Northern District of California Alleged infringer Cribl, Inc. was founded in 2017 by former Splunk employees, According to Splunk’s complaint, Cribl infringed patents awarded to Splunk for its 11 foundational innovations, developed and marketed products by making unlicensed copies of 12 Splunk’s copyrighted software, and used misappropriated information to compete unfairly. 13 Relevant here, Splunk asserted five patents: U.S. Patent Nos. 9,208,206; 9,762,443; 14 10,805,438; 10,255,312; and 9,838,467. The applications were filed between 2014 and 2019, 15 and the patents issued between 2015 and 2020. Once Splunk refiled its complaint in this 16 district, Cribl and CEO Sharp moved to dismiss patent and copyright claims (Dkt. No. 31). 17 The prior order granted the motion to dismiss with respect to Splunk’s patent claims and 18 denied it with respect to Splunk’s copyright claims. Specifically, that order granted the motion 19 as to all claims for direct patent infringement against Cribl based on ineligibility, as well as all 20 claims for willful and indirect patent infringement against Cribl based on separate grounds. 21 Meanwhile, it denied the motion as to all claims for indirect copyright infringement against 22 Cribl and CEO Sharp, as well as the claim for violation of Digital Millennium Copyright Act 23 Section 1202 against CEO Sharp (Dkt. No. 55). 24 25 The order on the motion to dismiss allowed Splunk to move for leave to amend its complaint, which Splunk has now done. This order follows full briefing and oral argument. 26 ANALYSIS 27 Federal Rule of Civil Procedure 15(a)(2) provides that leave to amend shall be freely 28 given when justice requires it. “[A] district court should consider several factors including 2 1 undue delay, the movant’s bad faith or dilatory motive, repeated failure to cure deficiencies by 2 amendments previously allowed, undue prejudice to the opposing party, and futility.” Brown 3 v. Stored Value Cards, Inc., 953 F.3d 567, 574 (9th Cir. 2020) (citing Foman v. Davis, 4 371 U.S. 178, 182 (1962)). “Futility of amendment can, by itself, justify the denial of a motion 5 for leave to amend. If no amendment would allow the complaint to withstand dismissal as a 6 matter of law, courts consider amendment futile.” Kroessler v. CVS Health Corp., 977 F.3d 7 803, 815 (9th Cir. 2020) (internal quotation and citations omitted). Splunk’s position is that amendment would not be futile because its proposed amended 8 complaint “supplies additional substantial factual detail and evidence that preclude dismissal at United States District Court Northern District of California 9 10 the Rule 12(b)(6) stage of Splunk’s (1) direct patent infringement claims under [Section] 101 11 and (2) willful and indirect patent infringement claims” (Br. 1). Upon review, this order 12 disagrees.1 * 13 * * Recall that under the Supreme Court’s Alice test for patent ineligibility, a claim falls 14 15 outside of Section 101 of the Patent Act if (1) it is directed to a patent-ineligible concept, like 16 an abstract idea, and (2) it lacks elements sufficient to transform it into a patent-eligible 17 application. Alice Corp. Pty. v. CLS Bank Int’l, 573 U.S. 208, 217–18 (2014). And, patent 18 eligibility is a question of law that may contain underlying questions of fact. Berkheimer v. HP 19 Inc., 881 F.3d 1360, 1365 (Fed. Cir. 2018). “[A]t step two of the Alice test, whether a claim 20 element or combination of elements is well-understood, routine and conventional to a skilled 21 artisan in the relevant field is a question of fact. However, of course, not every [Section] 101 22 determination contains genuine disputes over the underlying facts material to the [Section] 101 23 inquiry.” Sanderling Mgmt. Ltd. v. Snap Inc., 65 F.4th 698, 703 (Fed. Cir. 2023) (internal 24 quotations and citations omitted). When there are no factual allegations that, taken as true, 25 26 27 28 1 In their opposition, Cribl and CEO Sharp argue that amendment would be futile and, separately, that amendment would cause undue prejudice because Cribl has yet to file petitions for inter partes review (“IPR”) of the asserted patents and only has a few months left to do so. But it was Cribl’s choice not to file petitions for IPR. As such, this is not cognizable prejudice. At the hearing, the undersigned rejected the prejudice argument, and it will not be discussed further (Tr. 8:5–9:9, 10:5–18; see Opp. 23–25). 3 1 prevent resolution of patent-eligibility disputes as a matter of law, they may be resolved on a 2 Rule 12 motion. Uniloc USA, Inc. v. LG Elecs. USA, Inc., 957 F.3d 1303, 1306 (Fed. Cir. 3 2020). 4 Splunk argues that its amended factual allegations prevent resolution of this action’s 5 patent-eligibility disputes as a matter of law at this juncture because they “further explain how 6 the claims capture improvements over conventional technology and differ from conventional 7 practices associated with that technology” (Br. 1) (emphasis omitted). In its motion, Splunk 8 walks through language it seeks to add to its complaint with respect to each asserted patent (see 9 Br. 4–23). According to Splunk, its amended allegations raise factual disputes underlying the 10 United States District Court Northern District of California 11 Alice analysis, so amendment would not be futile. At the hearing, in support of using factual allegations to prevent resolution of patent- 12 eligibility disputes on a Rule 12 motion, counsel for Splunk quoted a passage from Cellspin 13 Soft, Inc. v. Fitbit, Inc., 927 F.3d 1306 (Fed. Cir. 2019) (see Tr. 20:8–21:10). In that case, the 14 Federal Circuit explained that it had “repeatedly cited allegations in the complaint to conclude 15 that the disputed claims were potentially inventive” in Aatrix, and “[w]hile [it] d[id] not read 16 [that case] to say that any allegation about inventiveness, wholly divorced from the claims or 17 the specification, defeats a motion to dismiss, plausible and specific factual allegations that 18 aspects of the claims are inventive are sufficient.” Cellspin, 927 F.3d at 1317 (citing Aatrix 19 Software, Inc. v. Green Shades Software, Inc., 882 F.3d 1121, 1128 (Fed. Cir. 2018)). Counsel 20 for Cribl and CEO Sharp responded by quoting the very next sentence in Cellspin: “As long as 21 what makes the claims inventive is recited by the claims, the specification need not expressly 22 list all the reasons why this claimed structure is unconventional.” Ibid. (emphasis added) (see 23 Tr. 21:21–23:18). 24 Therein lies the rub. True, “plausible and specific factual allegations that aspects of the 25 claims are inventive are sufficient” to defeat a motion to dismiss, but that requires “what makes 26 the claims inventive” to be “recited by the claims,” and it was not here. Cellspin, 927 F.3d 27 at 1317. “No amendment to a complaint can alter what a patent itself states.” Sanderling, 28 65 F.4th at 706. As observed in the prior order and explained at greater length in this order, 4 United States District Court Northern District of California 1 there is (still) a mismatch between what was broadly claimed by the five asserted patents and 2 what the specifications and Splunk’s (proposed amended) complaint say was claimed (see Dkt. 3 No. 55 at 15–16). Because the alleged improvements have not been captured in the claim 4 language, the validity of the claims does not turn on the factual question of whether the alleged 5 improvements are unconventional. The amended allegations, taken as true, do not prevent 6 resolution of this action’s patent-eligibility disputes.2 7 Consider the ’206 patent, entitled “Selecting Parsing Rules Based on Data Analysis.” It 8 describes a method for previewing the application of a parsing rule on a selection of raw data 9 in a graphical user interface and, in response to user input, processing a broader selection of 10 raw data with that parsing rule to create searchable, time-stamped events, “wherein the method 11 is performed by one or more computing devices” (’206 patent 20:45–67). The proposed 12 amended complaint provides historical context on search engine indexing to further support 13 arguments Splunk had made previously about the problem of “polluting” an index store if 14 events are not “well-defined” that the claimed invention ostensibly solved (see PAC ¶¶ 127– 15 31). None of the claims recite a mechanism for ensuring events are well-defined, however. It 16 is the user who decides if the rule should be applied based on the preview. Recognizing this, Splunk now alleges that the claims are directed to software that 17 18 “employs a non-conventional technique wherein index data is generated before and separately 19 from that data being stored in an index” (PAC ¶ 129; see Br. 16 (quoting PAC ¶¶ 129, 131)). 20 But the claims themselves do not even mention index data, let alone differentiate its generation 21 and storage. Elsewhere, Splunk contends that “[t]he graphical user interface contemplated by 22 these claims represents an important advance over conventional technology” and facilitates the 23 user’s data analysis decision-making (PAC ¶ 132; see Br. 17 (citing PAC ¶ 132); PAC ¶¶ 133– 24 34). Yet the Federal Circuit has made clear that the mere addition of a graphical user interface 25 does not transform an abstract idea (like previewing a data analysis rule before applying it) into 26 27 28 2 One instance in which allegations can prevent resolution of patent-eligibility disputes is when a patent owner alleges that claim construction is required before patent eligibility can be assessed. See Amdocs (Israel) Ltd. v. Openet Telecom, Inc., 841 F.3d 1288, 1300 (Fed. Cir. 2016). Counsel confirmed at the hearing that Splunk is not alleging this (Tr. 19:18–24). 5 1 a patent-eligible application. “Automation or digitization of a conventional method of 2 organizing human activity . . . does not bring the claims out of the realm of abstractness.” 3 Weisner v. Google LLC, 51 F.4th 1073, 1083 (Fed. Cir. 2022). The ’443 patent, entitled “Transformation of Network Data at Remote Capture Agents,” United States District Court Northern District of California 4 5 describes a method for a remote data capture agent to obtain configuration data, monitor 6 network data comprised of network packets, and generate and transform at least one network 7 packet into time-stamped event data based on the obtained configuration data (’443 patent 8 26:28–49). The ’438 patent, entitled “Configuring the Protocol-Based Generation of Event 9 Streams by Remote Capture Agents,” describes a method for such an agent to generate an 10 event data stream based on the network data it monitors in accordance with the configuration 11 data it received identifying a protocol and associated event attribute (’438 patent 24:26–45). 12 The prior order took these patents up together because Splunk took them up together (Dkt. 13 No. 55 at 16 (citing MTD Opp. 6–7, 13–17)). Although Splunk offers amended allegations to 14 differentiate the claimed technology from conventional technology, the alleged improvements 15 are not captured in the claims themselves, which are directed to abstract data manipulation.3 Splunk now identifies “configuration information” as “[a]t the core” of the claims’ 16 17 advances and emphasizes that the ability of the configuration information to be “changed at 18 any time,” “user-modifiable,” and adjusted “during runtime” reflects improvement in network 19 capture technology (Br. 6–8, 12–15 (quoting PAC ¶¶ 101, 118, 123)). The claims themselves, 20 however, do not call for this dynamic reconfiguration.4 As the prior order explained, the ’443 21 patent simply describes monitoring (network) data and applying (configuration) data received 22 to generate and transform (event) data. Meanwhile, the ’438 patent simply describes 23 generating (event) data by applying (configuration) data received to (network) data monitored. 24 25 26 27 28 The prior order said remote capture agents “can be physical hardware servers or virtual machines running in the cloud” when it should have said remote capture agents “may be installed on a physical server and/or in a virtual computing environment” (Dkt. No. 55 at 17 (quoting ’438 patent 4:65–5:2); ’438 patent 7:48–49) (emphases added). This does not affect any analysis, however. 3 Meanwhile, another asserted patent, entitled “Dynamically Instantiating Dual-Queue Systems,” claims “dynamically instantiating [a] dual-queue node” (’467 patent 24:36–37). 6 4 1 What’s more, specification language provides that “most” (not all) conventional network 2 capture technologies operate in a fixed manner, and “generally” (not always) cannot be 3 dynamically or easily modified (’443 patent 6:60–64). In other words, the patent itself betrays 4 that this is not the claimed invention. Hedging, Splunk points to other purported inventive concepts. For the ’443 patent, it United States District Court Northern District of California 5 6 focuses on the transformation of data at the remote capture agent, which “constitutes a further 7 technical advance” and ostensibly enables a more efficient, flexible usage of network resources 8 and a reduction of network traffic (PAC ¶¶ 105–06; see Br. 7 (citing PAC ¶¶ 104–06)). But 9 the only usage of network resources and reduction of network traffic claimed is that which 10 occurs as a result of transmitting event data in lieu of network packets, and the specification 11 makes clear that this was not itself unconventional (see ’443 patent 1:37–41). For the ’438 12 patent, Splunk again highlights the addition of a graphical user interface, which facilitates 13 “further configurability improvements” (Br. 12–14 (citing PAC ¶ 119)). This order has already 14 explained that the addition of such an interface is alone insufficient to transform an abstract 15 idea into a patent-eligible application. See Weisner, 51 F.4th at 1083. “[N]othing in the patent 16 contains any suggestion that the displays needed for th[is] purpose are anything but readily 17 available.” Elec. Power Grp., LLC v. Alstom S.A., 830 F.3d 1350, 1355 (Fed. Cir. 2016).5 The ’312 patent, entitled “Time Stamp Creation for Event Data,” describes a method for 18 19 creating a set of time-searchable events by segmenting machine data into event data and 20 associating that data with a given time stamp, “wherein the method is performed by one or 21 more computing devices” (’312 patent 17:9–48). The proposed amended complaint alleges 22 that “challenges stood in the way of building an index for a true ‘time series search engine’ for 23 raw time series machine data,” which “would require the ability to index arbitrary sets of 24 machine data, ranging from server logs to network packets to sensor data” (Br. 20 (quoting 25 26 27 28 5 Splunk attached to its motion a presentation that it alleges CEO Sharp prepared and that “confirms that [the claimed technology] was neither routine nor conventional” (Br. 4, 9–11, Exh. Q). It incorporated this presentation into its proposed amended complaint (PAC ¶¶ 107–12). Again, because the alleged improvements have not been captured in the claim language, this does not move the needle. 7 1 PAC ¶ 154)). In other words, “data from these heterogeneous sources needed to be 2 homogenized” (ibid.). Yet no such improvement is captured by the claim language. All that is 3 claimed is creating time-searchable events by determining whether time information is 4 available in segmented machine data, using time information from earlier processed events as a 5 proxy if time information is unavailable, and doing this on a computer. Cf. Alice, 573 U.S. 6 at 223. The proposed amended complaint states that the claims provide “a technique to 7 facilitate indexing raw time-series machine data regardless of its format or the presence of time 8 information within that data,” but no such technique is provided (PAC ¶ 158). The claims do 9 not even disclose how to calculate a time stamp when time information is unavailable. United States District Court Northern District of California 10 Splunk now contends that the claims “set forth a particular algorithm” (Br. 20 (quoting 11 PAC ¶ 158; see PAC ¶¶ 154, 158–62)). Calling this an algorithm does not make it any less 12 abstract, however. Moreover, Splunk avers that the claims “create searchable events suitable 13 to create an index for a time-based machine data search engine” and recite techniques “by 14 which the index that underpins such a search engine could be created” (Br. 20 (quoting PAC 15 ¶¶ 158, 163)) (emphasis added). As noted by Cribl and CEO Sharp, however, “tortuously 16 alleging an ‘improvement’ that is, at best, two steps removed from the claim language only 17 highlights the disconnect between the claimed invention and Splunk’s purported advance” 18 (Opp. 13). The Section “101 inquiry must focus on the language of the Asserted Claims 19 themselves.” ChargePoint, Inc. v. SemaConnect, Inc., 920 F.3d 759, 769 (Fed. Cir. 2019). 20 Finally, the ’467 patent, entitled “Dynamically Instantiating Dual-Queue Systems,” 21 describes a method for routing live data to a dual-queue node that, upon dynamic instantiation, 22 initializes a live data queue and a stale data queue, wherein the live data queue receives live 23 data for processing and the stale data queue stores a persistent backup (’467 patent 24:31–43). 24 The proposed amended complaint asserts that the claimed invention prevents the “over- 25 instantiation” of (pre-existing) dual-queue nodes, instantiating them “only when needed” (PAC 26 ¶ 147; see Br. 21 (citing PAC ¶¶ 137–39)). But all that is claimed is the dynamic instantiation 27 of a dual-queue node, with no limit on the number of instantiated dual-queue nodes and no 28 detail on why a dual-queue node may (or may not) be instantiated. 8 United States District Court Northern District of California 1 According to Splunk, the proposed amended complaint “adds supplemental allegations to 2 clarify that the claims are not directed to ‘handling overflow traffic,’ but instead are directed to 3 how to efficiently manage dual-queue data structures in a computer system that are used to 4 handle such traffic” (Br. 22 (quoting PAC ¶ 148)). Yet the claims do not disclose a solution to 5 the management problem identified in the specification (and Splunk’s original complaint) — 6 that of avoiding lost data when incoming live data arrives too quickly — beyond standard 7 caching and storing. Acknowledging the claimed invention relates to caching and storing, 8 Splunk now emphasizes that the claims “focus on problems associated with providing dual- 9 queue systems to many tenants” based on scalability and affordability (Br. 23 (citing PAC 10 ¶ 139); see PAC ¶¶ 138–39, 141–42). A concrete solution to those multi-tenant problems, 11 however, is not captured in the claim language, which merely “implement[s] a multi-tenant 12 dual-queue system” (’467 patent 24:31–32). 13 * * * 14 The Federal Circuit has recognized that “the specification cannot be used to import 15 details from the specification if those details are not claimed. Even a specification full of 16 technical details about a physical invention may nonetheless conclude with claims that claim 17 nothing more than the broad law or abstract idea underlying the claims, thus preempting all use 18 of that law or idea.” ChargePoint, 920 F.3d at 769. Likewise, the Federal Circuit has 19 recognized that a complaint cannot be used to import details from the specification or 20 elsewhere if those details are not claimed. Cellspin, 927 F.3d at 1317. Otherwise, a carefully 21 drafted complaint could always push patent-eligibility disputes to summary judgment or trial, 22 which would delay invalidation and waste considerable resources. 23 During the hearing, counsel for Splunk stated that “[w]hat Cellspin is about is you don’t 24 have to look at the patent, itself, to determine if it’s unconventional or not” and that “in fact, 25 prosecutors are trained not to be too specific about what’s new here, to leave some room in 26 litigation” (Tr. 23:13–17). That patent prosecutors draft broadly for a strategic advantage may 27 be true, albeit lamentable, but this order should draw into relief the risk they run in doing so. 28 Patents must specifically claim what they invent. Splunk reaped what it sowed. 9 Accordingly, Splunk’s amended allegations do not preclude dismissal of its direct patent 1 2 infringement claims, and amendment of Splunk’s complaint would be futile. Because the 3 patent claims remain ineligible, this order does not reach Splunk’s new arguments with respect 4 to willful and indirect infringement.6 5 CONCLUSION 6 For the foregoing reasons, Splunk’s motion for leave to file an amended complaint is DENIED. 7 IT IS SO ORDERED. 8 9 Dated: June 23, 2023. 10 United States District Court Northern District of California 11 12 WILLIAM ALSUP UNITED STATES DISTRICT JUDGE 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 6 Suffice to say, the undersigned is opposed to the idea that Cribl became knowledgeable of the asserted patents and their infringement on account of the complaint that Splunk filed in the District of Delaware before it refiled in this district. Splunk recognizes that the parties agreed upon dismissal and refiling to conserve resources (Br. 2). Surely Cribl never would have agreed to this had it known that this would impute knowledge. 10
]]>
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You
should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
