Splunk is the gold-standard data platform for security and observability — but its price tag makes most buyers gulp.
Splunk is a data-to-everything platform that has been the de facto standard in log management, security information and event management (SIEM), and observability since 2003. Founded by Erik Swan, Michael Baum, and Rob Das, the company pioneered the idea of indexing machine-generated data — logs, metrics, traces, and events — and making it instantly searchable through a custom query language called SPL (Search Processing Language).
Over two decades, Splunk evolved from a single log-search product into a broad platform spanning Splunk Enterprise (self-hosted), Splunk Cloud (managed), Enterprise Security (SIEM), Splunk SOAR (security orchestration), User Behavior Analytics, and Splunk Observability Cloud (APM, infrastructure, RUM, synthetics).
In March 2024, Cisco completed its approximately $28 billion acquisition of Splunk, folding the platform into Cisco's security and networking portfolio. As of 2026, the products remain branded Splunk, but roadmap decisions increasingly reflect Cisco's networking, security, and AI strategy (including integrations with Cisco Talos, ThousandEyes, and Webex data sources).
Commands like stats, timechart, transaction, and rex make SPL dramatically more flexible than vanilla SQL for ad-hoc investigations, threat hunting, and pivoting across data sources.
A full-featured SIEM with correlation searches, risk-based alerting, and a mature content library of detections aligned to MITRE ATT&CK — long considered the enterprise SIEM benchmark.
APM, infrastructure monitoring, real user monitoring (RUM), and synthetic checks, with AI-assisted root cause analysis. Acquired from SignalFx and Plumbr technologies.
Playbook-driven incident response (originally Phantom) lets security teams automate enrichment and remediation across hundreds of third-party tools.
Query data in place across S3, Azure Blob, or other Splunk instances without re-ingestion — a meaningful cost lever for cold data.
Over 2,000 apps on Splunkbase extend the platform with integrations for AWS, Okta, CrowdStrike, Palo Alto, ServiceNow, and many more.
Splunk has long been criticized for its pricing model, and the company overhauled it to address that friction. Today you'll encounter two main frameworks:
Workload Pricing (the newer model): Customers buy a pool of compute (SVCs — Splunk Virtual Compute units) and a pool of ingest (GB/day) that is shared across security, observability, and other workloads. This is more flexible than legacy ingest-only pricing and is now the default for new Splunk Cloud customers.
Ingest Pricing (legacy): Pay per GB/day ingested. Splunk Cloud plans typically start around ~$1,800 per GB/year for workloads like IT operations and security, though enterprise agreements vary widely. Self-hosted Splunk Enterprise is sold per GB or per node.
Free tier: Splunk removed its long-standing free 500 MB/day tier in 2023. The current Splunk Free offering is limited to 30 days of search and 10 GB of ingest — a meaningful regression for hobbyists and small teams. There is still a 60-day free trial of Splunk Cloud and Splunk Enterprise.
There is no published list price for Splunk Enterprise Security or SOAR — these are sold via enterprise sales with annual commitments that frequently run into the six- and seven-figure range for global organizations.
| Capability | Splunk | Elastic | Datadog | Microsoft Sentinel |
|---|---|---|---|---|
| Core strength | SIEM + log analytics + observability | Search & log analytics (ELK) | Cloud-native observability | Cloud-native SIEM on Azure |
| Query language | SPL | KQL / ES DSL / Lucene | Custom log search | KQL (Kusto) |
| Pricing model | Workload / ingest / entity | Resource-based / ingest | Per host, per GB, per million events | Per GB ingested + automation |
| Self-host option | Yes (Enterprise) | Yes (open source) | No | No (Azure only) |
| Best for | Large SOCs & enterprise ops | Engineering teams comfortable with OSS | Cloud-first DevOps teams | Microsoft-heavy enterprises |
No. Cisco completed the acquisition in March 2024, but Splunk products keep the Splunk brand and many sales motions. Roadmap, billing, and product integrations increasingly tie into Cisco's networking and security portfolio.
It depends entirely on data volume and which products you license. Small Splunk Cloud deployments can start in the low five figures annually; enterprise SIEM customers with SOAR commonly spend six to seven figures. Always ask for a custom quote and a PoC.
Workload Pricing separates compute (SVCs) from ingest (GB/day), letting you shift capacity between security and observability workloads as needs change. It replaced the old ingest-only model for most new cloud customers.
The historic 500 MB/day free tier was retired in 2023. A limited Splunk Free tier exists (10 GB ingest, 30-day search), and a 60-day free trial of Splunk Cloud and Enterprise is available.
SPL (Search Processing Language) is Splunk's proprietary query language. It's pipe-based and supports powerful commands like stats, timechart, transaction, and rex for manipulating time-series and event data.
Datadog is generally easier to deploy and cheaper for cloud-native observability, with strong APM, infra, and RUM. Splunk is stronger for security analytics, custom log investigation, and very high-volume enterprise environments.
Yes. Splunk Cloud runs on AWS and GCP with regional data residency options, and self-hosted Splunk Enterprise can be deployed on any infrastructure you control, including Azure and on-prem.
Splunk maintains a certification program including Splunk Core Certified Power User, Splunk Enterprise Certified Admin, and Splunk Enterprise Certified Architect, plus role-based tracks for security and observability.
Splunk is still the most capable security and observability data platform on the market, and Cisco's distribution muscle is likely to deepen its enterprise footprint. But pricing remains painful, the free tier is a shadow of what it was, and product direction is shifting under new ownership. If you have enterprise-scale needs and a healthy budget, Splunk is still worth a serious look — but make sure to run a competitive PoC against Datadog, Elastic, or Sentinel before you sign.
Get a custom quote, start a proof of concept, or compare Splunk Cloud vs. Enterprise with a Splunk specialist.
Get started with Splunk →Security engineers utilize Splunk for real-time threat detection, security incident and event management (SIEM), and forensic analysis, consolidating security data for comprehensive visibility. This enables rapid response to cyber threats and compliance monitoring.
DevOps teams implement Splunk for end-to-end observability, monitoring application performance, infrastructure health, and user experience. This helps in quickly identifying and resolving running issues across complex microservices architectures.
IT workflows managers deploy Splunk to centralize log management, monitor system health, and manage incidents across their entire IT estate. This reduces downtime and improves running efficiency by providing a single pane of glass for all machine data.
Quarterly access to product leadership.
Bonus credits redeemable on partner tooling.
We re-verify the offer every quarter so it never goes stale.
Hit the button on this page — opens the partner site in a new tab.
Check your investor or accelerator benefits portal for the Splunk partner code. Y Combinator, Sequoia, and most Tier 1 VCs have codes available.
Renewals stay at the same rate — verified by us, not the vendor.
| Feature | Splunk |
|---|---|
| Free trial | 14 days |
| Cheapest paid plan | $0/mo |
| Annual discount | Up to 25% |
| Refund window | 30 days |
| Setup time | < 1 hour |
| Best for | Founders |
“Best SIEM for compliance-driven industries — pricing is the only barrier”
“Powerful but Datadog and Elastic offer better value for most observability needs”
“Undisputed leader for enterprise SIEM — SPL makes complex correlations possible”
6 months free for founders
Verified offer
Verified offer
Verified offer
Verified offer
Verified offer
Free trial available
Verified offer
