Over the past decade, the observability market fractured into logs, metrics, traces, APM, RUM, data observability, and security telemetry. Now it is rapidly reconsolidating, with a second wave underway: security and AI platforms are buying the data pipelines that feed them. The thirteen companies below illustrate this pattern. Where possible, transaction prices, dates, and outcomes are cited from primary sources, SEC filings, and financial press.
1. Cisco: Three Deals, One Platform
AppDynamics (2017, $3.7B). Announced on January 24, 2017, the night before AppDynamics' planned IPO. The price was more than double the valuation the company would have fetched at IPO, amounting to roughly 17 times AppDynamics' annual run-rate revenue. The deal brought application performance monitoring to Cisco, giving the company visibility from the network all the way down to the application layer.
Result: AppDynamics became the foundation of the Cisco Full-Stack Observability platform. Seven years later, it was folded into Cisco's messaging alongside the Splunk platform, with CEO Chuck Robbins describing this as combining application, network, and hybrid cloud visibility in one place.
ThousandEyes (2020, approx. $1B, price never officially confirmed). Added internet and network path monitoring, effectively providing infrastructure visibility that Cisco lacked.
Result: Three years later, Cisco continued developing this same line by acquiring Accedian and SamKnows to feed ThousandEyes with additional network performance data. The product remains a promoted and actively developed line.
Splunk (announced September 2023, closed March 18, 2024, $28B in cash, $157 per share). Cisco's largest acquisition ever, valued at roughly 7 times Splunk's $4 billion annual recurring revenue. The rationale was to combine Splunk's data and security platform with Cisco's AppDynamics and ThousandEyes assets, and to bolster Cisco's AI-driven threat detection efforts. Splunk brought its own long history of acquisitions, meaning Cisco inherited SignalFx, VictorOps, Plumbr, and several security tools in a single transaction. Too early to judge.
2. IBM: Four Deals Across Two Observability Tiers
Instana (announced November 2020, price undisclosed). APM and hybrid cloud application complexity observability, supporting the IBM Cloud Pak for Watson AIOps strategy.
Turbonomic (announced April 2021, $1.83B according to later IBM filings, Reuters initially estimated $1.5 to $2B). Application resource management, workload placement optimization, and AI-driven cost management, framed by IBM as explicitly complementary to Instana.
Result: IBM deployed a bi-directional Instana and Turbonomic integration, allowing Turbonomic's cost and placement recommendations to respond to incidents detected by Instana. Five years post-Instana acquisition, this combination is an available and promoted feature rather than a shelved asset.
Databand.ai (announced July 2022, price undisclosed, previous funding $14.5M). An entirely different tier of observability: data observability, detecting bad data such as bugs, pipeline failures, and schema drift before it hits analytics or machine learning systems. This was IBM's fifth acquisition of 2022, positioned as an extension of observability from infrastructure and applications to the data pipelines themselves. It was integrated into IBM's Data and AI division alongside Instana and Watson Studio.
Manta (October 2023, price undisclosed). A data lineage company automating the mapping of data flow across organizational systems. Added to the same data observability cluster as Databand.
3. ServiceNow: Building Cloud Observability from Parts
Lightstep (announced May 2021, closed June 2021, approx. $510M). Founded by Ben Sigelman, co-creator of OpenTelemetry. Brought distributed tracing and metrics for cloud-native applications.
Era Software (announced October 2022, price undisclosed). Added log management with schema-free storage, explicitly positioned as a complement to Lightstep for a full logs, metrics, and traces stack.
Result: In May 2023, ServiceNow launched ServiceNow Cloud Observability as an integrated product built on both acquisitions, then in August 2023 fully rebranded Lightstep under that name, a real, deployed, and rebranded product line rather than a discarded brand.
4. Splunk: The Acquirer Before Being Acquired
SignalFx (announced August 2019, closed October 2019, $1.05B, approx. 60% cash and 40% stock). Cloud infrastructure monitoring and real-time metrics, intended to make Splunk competitive in APM and observability for cloud-native workloads.
Result: SignalFx became the backbone of Splunk Observability Cloud and was presented as critical infrastructure all the way until Splunk's ultimate sale to Cisco in 2024, four and a half years later, rather than being abandoned. Splunk's broader shopping list during the same period included VictorOps (incident response, 2018), Plumbr (APM, 2018), Rigor (digital experience monitoring, 2019), and Omnition (distributed tracing, 2019). By 2023, an industry analyst described Splunk as having accumulated more point-solution acquisitions than it fully integrated across both observability and security, pointing to a pattern of buying faster than absorbing.
5. Datadog: Completing Pipeline and Perimeter
Sqreen (announced February 2021, closed April 2021, price undisclosed). A French application security platform detecting real-time threats inside applications, adding runtime application self-protection to Datadog's baseline monitoring.
Timber Technologies and Vector (announced February 2021, price undisclosed). Timber created Vector, an open-source, vendor-agnostic pipeline for collecting, transforming, and routing logs and other observability data, including in on-premises deployments.
Result: Both acquisitions were announced in the same quarter Datadog reported 56% year-over-year revenue growth. Vector became part of Datadog's observability pipeline offerings, and Sqreen's technology underpins elements of Datadog's application security product line. Five years later, both remain active product lines.
6. Elastic: APM Through Acquisition
Opbeat (June 2017, amount undisclosed). A fifteen-person Copenhagen startup focused on JavaScript APM.
Result: This marked Elastic's entry into the APM segment, a category where the company previously lacked a product. By 2021, Elastic Observability was named a Visionary in the Gartner Magic Quadrant for APM, roughly four years after the acquisition, an example of a small, inexpensive, early-stage acquisition blossoming into a full product category.
7. Dynatrace: Discrete Acquisitions Despite Declaring Otherwise
Dynatrace historically described itself as a company that does not pursue a growth-through-acquisitions strategy, preferring in-house engineering instead. In practice, since 2021, it has made four targeted purchases, each closing a specific gap rather than buying scale.
SpectX (announced September 2021, price undisclosed). An Estonian fast log parsing and query analytics company aimed at accelerating the convergence of observability and security data analytics.
Rookout (announced July 2023, closed November 2023, $33.9M). An Israeli live-debugging platform enabling developers to fetch real-time data from running production code without redeploying, described by Dynatrace as closing a developer observability gap rather than a scale-buying move.
Runecast (announced January 2024, price undisclosed). AI-driven security posture management and compliance, adding automated vulnerability and misconfiguration detection across hybrid and multicloud environments to Dynatrace's security analytics.
Bindplane (announced April 2026, price undisclosed). A company building OpenTelemetry-native telemetry pipelines, managing log, metric, and trace collection, filtering, and routing at the network edge before hitting any backend. Dynatrace plans to keep Bindplane as an independent product available in multi-vendor environments rather than folding it solely into its own platform, explicitly to compete with specialized pipeline vendors like Cribl.
Rookout is old enough as an acquisition to be preliminarily evaluated: it was deployed as code-level observability inside the Dynatrace platform rather than remaining a separate SKU, aligning with Dynatrace's stated pattern of acquiring competencies rather than brands. The other three transactions are too fresh to judge.
8. Chronosphere: First an Acquirer, Then Acquired in Under Two Years
Calyptia (announced January 2024, price undisclosed). Founded by the creators of Fluent Bit and Fluentd, open-source log and metric collectors used in most major clouds. Chronosphere's rationale was to extend its cost-control platform to cover the first mile of telemetry pipelines.
Then Chronosphere itself. In November 2025, Palo Alto Networks announced it would acquire Chronosphere for $3.35B in cash and stock, with the deal closing on January 29, 2026. Palo Alto's CEO pitched it as a way to feed the Cortex AgentiX security platform with real-time observability data, highlighting that Chronosphere delivers observability at about one-third the cost of competing platforms. Palo Alto also announced that Chronosphere's telemetry pipeline will continue to be sold as a standalone product.
This is the shortest full cycle on this list: a company that itself consolidated a point solution was rolled up into a much larger security platform less than two years later.
9 and 10. The Battle for Telemetry Pipelines (2025 to 2026): Cribl, CrowdStrike, SentinelOne
Between 2021 and 2024, observability pipeline vendors like Cribl were mostly venture-backed independent companies selling infrastructure plumbing to other firms' platform wars. Starting in 2025, the category itself became an acquisition target, and one of its biggest players began buying companies in the opposite direction.
CrowdStrike acquired Humio (announced March 2021, $400M). Cloud log management with index-free ingestion, targeted at CrowdStrike's XDR ambitions.
Result: Humio was rebranded in 2022 to Falcon LogScale and, four years later, remains the core of CrowdStrike's log management and Next-Gen SIEM platform, integrated by third parties like Cloudflare and ExtraHop between 2023 and 2024, a lasting success by any measure.
CrowdStrike acquired Onum (announced August 2025, $290M). A Madrid-based telemetry pipeline and real-time data filtering platform bought explicitly to feed the CrowdStrike Falcon Next-Gen SIEM with pre-filtered real-time data and remove migration friction when onboarding external log sources. CEO George Kurtz called it a pipeline and filter. Too early to judge, but immediately positioned as the data foundation for CrowdStrike's SIEM roadmap rather than a side product.
SentinelOne acquired Observo AI (announced September 2025, price undisclosed). An AI-native observability data pipeline company focused on reducing log volume and telemetry costs for security and DevOps teams, designed to accelerate SentinelOne's AI-driven SIEM and data strategy.
Meanwhile, Cribl is acquiring rather than exclusively being a target. In July 2026, it acquired CardinalOps, an AI-native detection engineering company founded by Israeli 8200 intelligence unit veterans, adding automated detection coverage mapping on top of its telemetry pipeline. A month later, in August 2026, Cribl acquired Radiant Security's AI SOC technology assets, adding AI-generated security alert triage logic. Both moves shift Cribl away from pure telemetry routing toward direct participation in security operations, explicitly intending to challenge legacy SIEM vendors like Splunk and IBM QRadar ahead of Cribl's contemplated IPO.
Both transactions are too fresh to judge, but the pattern visible across all four 2025 to 2026 deals is identical: telemetry pipeline control is treated as a strategic layer that must be owned before AI-driven security operations reach scale, rather than a cheap commodity tool bought once and ignored.
11. Coralogix: Buying the AI Observability Gap
Aporia (announced December 2024, approx. $50M in cash and stock according to Israeli financial press). An Israeli AI observability and guardrails platform monitoring machine learning and generative AI systems in production for hallucinations, data leaks, bias, and prompt injections, previously named one of TIME's Best Inventions. Coralogix, a data observability platform operating since 2014, lacked dedicated AI monitoring tools, so it closed this gap in a single move and stated the transaction made it the first observability platform combining visibility into both software systems and AI.
Result: Within three months, Coralogix launched a dedicated AI Center and the Coralogix AI research division led by Aporia's former CEO and CTO. The technology has since been promoted as core to Coralogix's 2026 market positioning, including the company being named a Leader in the 2026 Gartner Magic Quadrant for Observability Platforms. Still too fresh for a multi-year verdict, but integration was fast and the acquired leadership stayed on to run the resulting unit, an outcome distinct from acquisitions where founding teams quietly depart.
12 and 13. Francisco Partners and TPG: Private Equity as a Different Kind of Consolidator
Not every acquirer in observability is a strategic buyer. Private equity funds took two major public observability companies private within months of each other in 2023.
Sumo Logic, acquired independently by Francisco Partners (announced February 2023, closed May 2023, $1.7B, $12.05 per share, a 57% premium over pre-announcement price).
New Relic, acquired jointly by Francisco Partners and TPG (announced July 31 2023, closed November 8 2023, $6.5B, $87 per share, a 26% premium). New Relic subsequently ran a 45-day go-shop period, contacting 53 potential buyers, and none made a competitive offer.
The rationale in both cases was identical: take a public observability company out from under the pressure of quarterly earnings so it can rebuild pricing and products without market scrutiny. In New Relic's case, this meant specifically completing a multi-year transition from subscription models to consumption-based pricing. These are still too fresh for a full verdict, but both companies have continued operating as independently branded entities as of 2026 rather than being rolled into a strategic buyer's portfolio, which precisely constitutes the structural difference between a private equity buyout and a strategic acquisition.
What This Pattern Shows
Placing the thirteen acquirers side by side reveals three driving forces.
Feature completeness, 2017 to 2022
No single observability vendor simultaneously covered logs, metrics, traces, security, and cost optimization, so acquiring was faster than building every competency from scratch. The cleanest examples are IBM buying Turbonomic explicitly to complement Instana, and ServiceNow buying Era Software explicitly to round out Lightstep. Both brought real, deployed, and integrated products rather than shelved brands.
Data and AI observability as a distinct category, from 2022
IBM's deals for Databand and Manta, and Coralogix's deal for Aporia, are not about logs, metrics, or traces. They are about the reliability and behavior of data itself and AI systems, with each buyer purchasing that competence from a company that possessed a product the buyer previously lacked.
Telemetry pipeline control as a battleground, 2025 onward
Four transactions in eighteen months, Dynatrace and Bindplane, CrowdStrike and Onum, SentinelOne and Observo AI, and Cribl's own purchases of CardinalOps and Radiant Security, treat the pipeline layer, the software deciding what telemetry is kept, filtered, and routed before hitting any analytics backend, as a strategic bottleneck of the AI era. This is a fundamentally different logic than the 2017 to 2021 wave, where observability vendors bought features to complete a platform. The 2025 to 2026 wave means security and AI platforms are buying the data supply chain itself, operating on the premise that whoever controls the telemetry seen by an AI system controls that system's utility in detecting and resolving problems. It remains to be seen whether this logic pulls additional independent pipeline and data observability vendors into its orbit through the rest of 2026.