Price checkMonthly
Splunk On-Call$5/user/moSplunk AppDynamics - Infrastructure Edition$6/user/moSplunk Observability Cloud - Infrastructure$15/user/mo
See all 11 plans

All Splunk Plans & Pricing

Some prices not re-verified — only plans marked “checked” were confirmed on the vendor’s pricing page

Plan Monthly Annual Best For
Splunk On-Call checked Oct 31, 2026 Annual billing only Not specified
Splunk AppDynamics - Infrastructure Edition checked Oct 31, 2026 Annual billing only Not specified
Splunk Observability Cloud - Infrastructure checked Oct 31, 2026 Annual billing only Not specified
Splunk AppDynamics - Premium Edition checked Oct 31, 2026 Annual billing only Not specified
Splunk AppDynamics - Enterprise Edition checked Oct 31, 2026 Annual billing only Not specified
Splunk Observability Cloud - App & Infra checked Oct 31, 2026 Annual billing only Not specified
Splunk Observability Cloud - End-to-End checked Oct 31, 2026 Annual billing only Not specified
Splunk Agent Observability checked Oct 31, 2026 Annual billing only Not specified
View all features by plan (compare side-by-side)

Splunk On-Call

Splunk AppDynamics - Infrastructure Edition

Splunk Observability Cloud - Infrastructure

Splunk AppDynamics - Premium Edition

Splunk AppDynamics - Enterprise Edition

Splunk Observability Cloud - App & Infra

Splunk Observability Cloud - End-to-End

Splunk Agent Observability

Workload Pricing

  • Based on workload types
  • Full platform access
  • Flexible scaling

Ingest Pricing

  • Based on data volume
  • Full platform access
  • Predictable costs

Entity Pricing

  • Based on number of hosts
  • Controllable costs
  • Full features
Pricing Alerts

Track Splunk pricing

Get an email when Splunk's pricing changes — plus the weekly SaaS Price Watch: verified price changes and deals across 3,000+ products. One-click unsubscribe.

Try Splunk Free
Compare Splunk with alternativesAdjust seats, lock a tier, add up to 2 more products side-by-side. Shareable URL.
At a glance

List price by tier (annualized, per license)

Per-license list price across Splunk's plans, annualized. Custom-priced tiers show a hatched bar.

Splunk On-Call$60/yr
Splunk AppDynamics - Infrastructure Edition$72/yr
Splunk Observability Cloud - Infrastructure$180/yr
Splunk AppDynamics - Premium Edition$396/yr
Splunk AppDynamics - Enterprise Edition$600/yr
Splunk Observability Cloud - App & Infra$720/yr
Splunk Observability Cloud - End-to-End$900/yr
Splunk Agent Observability$1.2K/yr
Workload PricingCustom
Ingest PricingCustom
Entity PricingCustom
Quick Answer
Last verified:
Estimate

Splunk costs $5 to $100 per month as of November 2026, with 11 plans available. Plans: Splunk On-Call at $5/user/month (billed annually), Splunk AppDynamics - Infrastructure Edition at $6/user/month (billed annually), Splunk Observability Cloud - Infrastructure at $15/user/month (billed annually), Splunk AppDynamics - Premium Edition at $33/user/month (billed annually), Splunk AppDynamics - Enterprise Edition at $50/user/month (billed annually), Splunk Observability Cloud - App & Infra at $60/user/month (billed annually), Splunk Observability Cloud - End-to-End at $75/user/month (billed annually), and Splunk Agent Observability at $100/month (billed annually). Custom pricing is available on request. Pricing depends on your chosen tier, contract length, and negotiated discounts.

Use the interactive pricing calculator to estimate your exact cost based on team size and requirements.

  • Free tier: No free tier available

Splunk offers 11 pricing tiers: Splunk On-Call, Splunk AppDynamics - Infrastructure Edition, Splunk Observability Cloud - Infrastructure, Splunk AppDynamics - Premium Edition, Splunk AppDynamics - Enterprise Edition, Splunk Observability Cloud - App & Infra, Splunk Observability Cloud - End-to-End, Splunk Agent Observability, Workload Pricing, Ingest Pricing, Entity Pricing. Paid plans include Splunk On-Call at $5/user/month (billed annually), Splunk AppDynamics - Infrastructure Edition at $6/user/month (billed annually), Splunk Observability Cloud - Infrastructure at $15/user/month (billed annually).

Compared to other observability platforms software, Splunk is positioned at the budget-friendly price point.

  • Median contract: $60,000/yr from 0 purchases Thin data
  • Average negotiated discount: 15%
  • 8 documented hidden costs beyond list price
Last verified:

How much does Splunk cost?

Splunk has a free plan; paid plans start at $5/user/mo, billed annually. Enterprise pricing is quote-based. Plans include Splunk On-Call at $5/user/month (billed annually), Splunk AppDynamics - Infrastructure Edition at $6/user/month (billed annually), Splunk Observability Cloud - Infrastructure at $15/user/month (billed annually), Splunk AppDynamics - Premium Edition at $33/user/month (billed annually), Splunk AppDynamics - Enterprise Edition at $50/user/month (billed annually), Splunk Observability Cloud - App & Infra at $60/user/month (billed annually), Splunk Observability Cloud - End-to-End at $75/user/month (billed annually), Splunk Agent Observability at $100/month (billed annually), Workload Pricing (custom pricing), Ingest Pricing (custom pricing), Entity Pricing (custom pricing).

Splunk Pricing Overview

Splunk has 11 pricing plans ranging from $5 to $100/month. The Splunk On-Call plan costs $5/user/month (billed annually). The Splunk AppDynamics - Infrastructure Edition plan costs $6/user/month (billed annually). The Splunk Observability Cloud - Infrastructure plan costs $15/user/month (billed annually). The Splunk AppDynamics - Premium Edition plan costs $33/user/month (billed annually). The Splunk AppDynamics - Enterprise Edition plan costs $50/user/month (billed annually). The Splunk Observability Cloud - App & Infra plan costs $60/user/month (billed annually). The Splunk Observability Cloud - End-to-End plan costs $75/user/month (billed annually). The Splunk Agent Observability plan costs $100/month (billed annually). The Workload Pricing plan requires contacting sales for a custom quote and is designed for organizations with varied workloads. The Ingest Pricing plan requires contacting sales for a custom quote and is designed for organizations with predictable data volumes. The Entity Pricing plan requires contacting sales for a custom quote and is designed for organizations wanting host-based pricing.

Splunk with a Typically annual contracts minimum commitment.

The median Splunk customer pays $60,000/year, with an average 15% discount available through negotiation.

There are at least 8 documented hidden costs beyond Splunk's list price, including implementation, training, and add-on fees.

This pricing was last verified in July 21, 2026.

Try Splunk Free

Splunk pricing is based on custom quotes for Workload, Ingest, and Entity pricing models. A free tier exists with 500MB/day ingestion, suitable only for testing—it lacks authentication, alerting, and SIEM features. Production deployments require Splunk Enterprise, with base pricing starting around $15,000/year for 5GB/day. Enterprise Security (ES) add-on costs an additional $10,000+/year minimum for true SIEM functionality. Large-scale deployments can exceed $500,000/year when including infrastructure, data pipeline tools, and professional services.

How Splunk Pricing Compares

Compare Splunk pricing against top alternatives in Observability Platforms.

Chronosphere Custom pricing Compare → Grafana Cloud $0-$55/user/mo Compare → Datadog Custom pricing Compare →

Compare Splunk vs Alternatives

Before committing to Splunk, compare pricing with these 3 alternatives in the same category.

VSChronosphere
Custom

General users

Full comparison
VSGrafana Cloud
Free

Individual developers and small projects

Full comparison
VSDatadog
Custom

Full comparison

All Splunk alternatives & migration guides

What Companies Actually Pay for Splunk

The median Splunk buyer pays $60,000/year based on 0 buyer-reported purchases, with an average 15% savings through negotiation.

What companies actually pay $60,000/yr Median across 0 buyer-reported purchases Thin data
15% avg. savings
with negotiation
Review scores
Third-party review aggregates, as of May 2025
Top pricing complaints
Prohibitively expensive pricing modelPer-GB ingestion pricing drives cost-cutting measures that reduce valueOpaque pricing - difficult to get quotes without lengthy sales processVendor lock-in concerns
Source: Costbench estimate based on published Splunk Cloud pricing tiers and typical enterprise deployments

Splunk Cost by Company Size

Example costs for teams of different sizes. Each figure is labelled with the period it covers.

Small Business (1-10GB daily) $1,800 - $18,000 per year

$1,800 - $18,000 per year (license only); implementation and training are additional and vary by deployment

Entry-level deployment for small businesses ingesting 1-10GB of data per day with basic observability and security monitoring needs.

Medium Enterprise (50GB daily) $50,000 - $90,000 per year

$50,000 - $90,000 per year (license), additional 30-50% for infrastructure, storage, and maintenance

Mid-sized organization ingesting approximately 50GB daily with moderate data retention and analysis requirements across multiple teams.

Large Enterprise (500GB+ daily) Custom-quoted; total annual cost depends on licensing, infrastructure, storage overhead, and operational costs

Enterprise-scale deployment ingesting 500GB or more daily with advanced security operations, full observability stack, and high availability requirements.

Observability Cloud (Host-based) $180 estimated cost

$180+ per month based on number of monitored hosts, starting at approximately $2,160 annually

Splunk Observability Cloud with entity-based pricing starting tier for application performance monitoring and infrastructure observability.

Small Business (5GB/day, 100 endpoints) Custom-quoted (license only, does not include ES add-on or infrastructure)

Base Splunk deployment for small organization with 100 endpoints sending Windows Event Logs, firewall logs, and basic application logs. ~5GB/day ingestion.

Mid-Size Enterprise with SIEM (50GB/day, 1,000 endpoints) $100,000-$150,000 Year 1 total
estimated based on ~$4/GB pricing
ES add-on
infrastructure
Total $100,000-$150,000

Mid-size deployment with 1,000 endpoints, requiring Enterprise Security add-on for SIEM functionality, correlation rules, and incident management. Includes firewall, IDS, endpoint, and cloud logs.

Large Enterprise (High Volume) Custom-quoted annual pricing for Splunk alone; no published number

Fortune 500 company with substantial log ingestion needs

Small-Medium Business (Low Volume) $0 estimated cost

$0 (Free tier: 500MB/day) - but severely limited functionality

SMB with basic logging needs at free tier limits

How Splunk Pricing Compares

Software Starting Price Top Price
Splunk $5/month $100/month
Baselime (Cloudflare) Custom Custom
Chronosphere Custom Custom
Coralogix Observability $0.06/GB $1.5/GB
Datadog Free $41/month
Grafana Cloud Free $2083.33/month

Detailed pricing comparisons:

Browse all Observability Platforms pricing →

8 Splunk Hidden Costs Beyond the List Price

Beyond the listed price, Splunk has at least 8 documented hidden costs that can significantly increase total cost of ownership.

Watch for 8 hidden costs
  • Enterprise Security (ES) Add-on Required for SIEM $10,000/year minimum (source dated May 2019)
    critical 2 sources
    Reddit “splunk is one of the most cost friendly options out there, but you need to get the Enterprise Security add-on for full incident management capabilities. ELK is capable of doing SIEM like functionality, but isn't a true siem.”
    Reddit “I've used Splunk in a pervious environment, and despite it being the 800 lb gorilla, I wasn't impressed. It seemed to do log collection and searching just fine, but was otherwise meh.”
  • Data Pipeline Tools to Control Ingestion Costs 20-30% of license costs
    high 2 sources
    Reddit “Completely agree. If you don't know how to limit the stuff going into the SIEM to security relevant, or at least use case relevant, then any throughput based licensing is going to get out of hand cost wise. That's true for any SIEM.”
    Reddit “Cribl is among a new category of tools that help decouple data ingestion from SIEMs and platforms such as Splunk. Forrester is calling this "Data Pipeline Management", and you can read more about it here - https://www.forrester.”
  • On-Premise Infrastructure and Storage Costs 15-25% of license costs
    high 2 sources
    Reddit “Full disclosure: I'm a resident engineer who works at Gravwell embedded at one of our larger enterprise clients. Splunk is a great tool that has been the de facto leader in the space for a long time for a reason.”
    Reddit “Try Humio (www.humio.com): - 90% less expensive than Splunk - 1 Humio node can do the work of 4-5 Splunk nodes, 7-10 ES nodes.”
  • Training and Expertise Costs 5-10% of license costs
    medium 2 sources
    Reddit “Every SIEM will be daunting. You'll need to do training and your company should cover that. If they cheap out you'll end up with a poorly run SIEM that slows down significantly over time and doesn't really serve much purpose except log storage.”
    Reddit “From my personal experience Qradar is a somewhere in the middle in terms of complexity, practicality (ability to be managed on prem or in the cloud) and price.”
  • Cloud Egress Charges When Integrating with Azure/AWS $500-$5,000/month
    medium 1 source
    Reddit “Try shunting gigabytes of log data to Splunk from Azure and watch your egress bills 😃”
  • Data Loss from Cost Management Cannot be quantified - operational risk
    critical 1 source
    Reddit “their pricing is so trash that the workloads that truly can take advantage of the power inherent within Splunk are also the ones where the pricing becomes cost prohibitive.”
  • Vendor Lock-In Migration Costs $50,000-$500,000 (source dated Jul 2024)
    high 1 source
    Reddit “woe be unto the enterprise that moved into cloud without learning the lessons that Hashicorp tried to teach everyone about abstracting your infrastructure so that you can move it when you need to.”
  • Professional Services and Implementation $100-$200/hour for consultants
    medium 1 source
    Reddit “I priced myself at $100/hr and and in no time, clients came out... I could have had looked at the local cyber consulting businesses, which I may be able to undercut them, even up to $200/hr.”
Tip

Ask your Splunk sales rep about these costs upfront. Getting them in writing before signing can save you from surprise charges later.

Full hidden costs breakdown →

Intelligence sourced from 1 independent sources
Reddit User discussions
Key claims include inline source attribution. Data verified against multiple independent sources. 23 source citations total.

Splunk Contract Terms

Splunk contracts do not auto-renew. Changes require advance notice. These terms are sourced from verified buyer experiences.

Contract Terms
Auto-Renewal No
Minimum Commitment Typically annual contracts
Mid-Term Downgrade Not allowed
Payment Terms Must purchase through resale partners
Price Escalation Pricing model changes and increases over time - incentive pricing melts away during renewals
Based on 2 verified sources

How to Negotiate Splunk Pricing

Splunk contracts are negotiable — buyers save an average of 15% off list price. These 8 tactics are sourced from real buyer experiences and procurement specialists.

Negotiation Playbook 8 tactics
Compare with Lower-Cost Alternatives high success

Mention competing products like Rapid7 InsightIDR (asset-based, unlimited data), Microsoft Sentinel (cheaper for Azure/M365 shops), Elastic, or Gravwell during negotiations. One user reported Splunk was 4x the cost of Rapid7. Use this competitive pressure to push for aggressive discounting.

Reddit: 'Sorry, but completely disagree at least based on the current market. I just went through an RFP for a SIEM replacement and you are quite a bit off. Splunk was over 4 times the cost of Rapid7 due to the need for the main function and then ESM. Also, Rapid7 goes off asset pricing and does an unlimited data model for their cloud platform currently.' (2021-10-13)
Implement Data Pipeline Tool to Reduce Volume high success

Before renewal, deploy Cribl or similar tools to pre-filter and reduce ingestion volume by 30-60%. Then renegotiate based on lower tier. This demonstrates cost-consciousness and gives you leverage to demand better per-GB rates.

Reddit: 'I know organizations that bought Cribl to front their Splunk inputs and manage data ingest just to reduce cost. Splunk is an amazing tool with a lot of community support but I hate the pricing model.' (2024-02-21)
Work Through Resale Partners high success

Splunk requires purchasing through resale partners rather than direct. Partner selection can impact pricing and support quality.

Reddit discussion on purchasing process
Start Small with Base Tier and Negotiate Volume Discounts medium success

Splunk's base pricing starts around $15k/year for 5GB/day. If you're a small organization, negotiate from this baseline rather than accepting enterprise pricing. For larger deployments, push for tiered volume discounts as your daily ingestion grows.

Reddit: 'After around ~2 hours communicating with 2 people on their side, and a couple more hours alone. We learned that their base price was a 5gb/day tier for ~15k/year.' (2023-04-17)
Use SaaS/Cloud Pricing to Compete with On-Prem medium success

Splunk Cloud and on-premise have different pricing structures. If quoted on-prem, ask for cloud pricing and vice versa. Cloud options may include storage/infrastructure in the price, while on-prem requires you to provision hardware.

Reddit: 'For security reasons, it's highly not recommended to install any agents on the Vault servers themselves - but rather use the SIEM integration (and SNMP traps via PARAgent). For the component servers you can treat them as any other server in your environment (for logging purposes) and install the requisite agents on them... In some situations (SPLUNK), you may want to limit the amount of logs that get taken in, due to financial (per MB pricing) or space limitation.' (2019-05-02)
Highlight Cisco Acquisition Uncertainty medium success

Following Cisco's acquisition of Splunk, the product's future direction is uncertain. Use this as leverage to negotiate shorter contract terms, price protection clauses, or better discounts due to the integration risk.

Reddit: 'Cisco also recently bought it, which has thrown some questions on the products future due to their track record with acquisitions outside their core networking competency.' (2025-04-05)
Enterprise Agreement Negotiation medium success

Large organizations can negotiate enterprise-wide agreements with potentially better per-GB rates, though pricing remains volume-dependent.

Reddit discussions of enterprise pricing
Evaluate Workload-Based Pricing medium success

Splunk offers workload-based pricing ($41/core mentioned) as alternative to ingest-based pricing. Compare both models based on your usage patterns.

Reddit discussion of pricing models
High success Medium Low / difficult

Full negotiation guide →

Splunk Pricing FAQ

01 Is the free version of Splunk sufficient for SIEM use?

No. Splunk Free is limited to 500MB/day ingestion and lacks critical SIEM features including authentication, alerting, distributed search, and clustering. For actual SIEM functionality, you need Splunk Enterprise plus the Enterprise Security add-on, which costs at minimum $10,000/year on top of the base license. The free version is suitable only for testing and very small-scale log collection.

02 How does Splunk's pricing compare to alternatives like Rapid7 or Microsoft Sentinel?

Splunk is typically 3-4x more expensive than alternatives. One organization reported Splunk was over 4 times the cost of Rapid7 InsightIDR. Rapid7 uses asset-based pricing with unlimited data ingestion, while Splunk charges per GB ingested. Microsoft Sentinel is cheaper for organizations already in the Azure/M365 ecosystem. Elastic/ELK is cheaper but requires more technical expertise to operate.

03 What is Splunk's base pricing tier?

Splunk's base tier starts around $15,000/year for 5GB/day ingestion. However, this does not include the Enterprise Security add-on (required for SIEM functionality, adds ~$10k/year minimum), infrastructure costs for on-premise deployments, or professional services. Actual pricing varies significantly based on volume and negotiation.

04 Why do organizations use Cribl with Splunk?

Organizations deploy Cribl or similar data pipeline tools to pre-process and filter logs before they reach Splunk, reducing ingestion volume by 30-60%. This is done specifically to manage Splunk's expensive per-GB pricing model. The cost of adding Cribl is often justified by the savings in Splunk licensing fees.

05 Does Splunk Enterprise include incident management and correlation out of the box?

No. Splunk Enterprise is primarily a data analytics platform. To get true SIEM capabilities like correlation, case management, security dashboards, and incident workflows, you must purchase the Enterprise Security (ES) add-on separately. This is a significant additional cost on top of the base platform license.

06 Why is Splunk so expensive compared to alternatives?

Splunk uses a per-GB ingestion pricing model that scales costs rapidly with data volume. While Splunk is technically powerful and can handle massive scale, the pricing structure makes it prohibitively expensive for many use cases. Organizations often spend 15-30% additional budget on pre-processing tools like Cribl just to reduce ingestion costs. One enterprise reported spending $10M annually on Splunk alone.

07 Can I use Splunk for free?

Yes, Splunk offers a Free tier limited to 500MB/day ingestion, but it lacks critical enterprise features including authentication, alerting, distributed search, and clustering. It's suitable only for testing and lab environments, not production SIEM use.

08 How does Splunk's pricing model work?

Splunk offers multiple pricing models: ingest-based (per GB of data ingested per day), workload-based (per core), and entity-based pricing. You must purchase through authorized resale partners. Pricing is not publicly transparent and requires lengthy sales discussions to obtain quotes.

09 What happens to Splunk pricing after the Cisco acquisition?

The Cisco acquisition has created uncertainty. Users report concerns that Cisco's track record with acquisitions may lead to further price increases, product stagnation, or bundling requirements. Some organizations are evaluating alternatives due to this uncertainty.

10 What are cheaper alternatives to Splunk?

Users frequently mention Gravwell (reported as 1/7th the cost), Google Chronicle, Microsoft Sentinel (though with complex pricing for non-Microsoft sources), Elastic/ELK stack, and various other SIEM platforms. Most alternatives offer more predictable pricing models not based on data ingestion volume.

Is this pricing incorrect? — we'll verify and update it.