At a glance
- Deployment
- saas, self-hosted, hybrid
- Licence
- proprietary
- Categories
- log management, siem, observability platform, apm, metrics backend, tracing backend, rum synthetics, telemetry pipeline, incident management, llm observability
- Ownership
- Acquired by Cisco Systems, closed 2024-03-18
- Estimate
- Costed from published list prices
- Vendor-side sampling
- no
What it charges for
Every line item recorded for Splunk (Cisco). "Not stated" means the vendor's own page gives no number; it is never treated as zero.
| Line item | Unit | Commitment | List price | Sources |
|---|---|---|---|---|
| Observability Cloud Infrastructure | host-month | annual, billed annually | $15 | s1, s4 |
| Observability Cloud App & Infrastructure | host-month | annual, billed annually | $60 | s1 |
| Observability Cloud End-to-End | host-month | annual, billed annually | $75 | s1 |
| Observability Cloud custom metrics beyond host entitlement | custom-metric-series-month | contact sales | Not stated | s3, s5 |
| Observability Cloud usage-based Infrastructure Monitoring | custom-metric-series-month | contact sales | Not stated | s4 |
| Observability Cloud usage-based RUM | session-thousand | contact sales | Not stated | s4 |
| Observability Cloud Troubleshooting MetricSets | custom | contact sales | Not stated | s3 |
| Agent Observability (AI agent / LLM monitoring) | custom | annual, billed annually | $100 | s1 |
| Splunk On-Call | user-month | annual, minimum 10 seats | $5 | s2 |
| Splunk Cloud Platform ingest pricing | custom | annual or multi-year | Not stated | s2, s20 |
| Splunk Cloud Platform workload pricing (SVC) | credit | annual or multi-year | Not stated | s8, s9 |
| Splunk Cloud Platform storage blocks (workload pricing) | custom | annual | Not stated | s8 |
| Federated Search for Amazon S3 Data Scan Unit | custom | prepaid | Not stated | s10 |
| Splunk Enterprise term licence (reseller list, 1 GB/day) | custom | annual term, Standard Success Plan | Not stated | s21 |
| Splunk Enterprise term licence (reseller list, 10-19 GB/day) | custom | annual term, Standard Success Plan | Not stated | s21 |
| Splunk Enterprise term licence (reseller list, 50-99 GB/day) | custom | annual term, Standard Success Plan | Not stated | s21 |
| Splunk Enterprise term licence (reseller list, 100-199 GB/day) | custom | annual term, Standard Success Plan | Not stated | s21 |
| Splunk Enterprise term licence (reseller list, 1000-1999 GB/day) | custom | annual term, Standard Success Plan | Not stated | s21 |
How the estimate is built
The standard deployment is priced by these components (methodology). A quantity is a formula over the workload variables; free allowances are subtracted first, and a tier prices only its own band.
| Component | Line item | Quantity | Free | Tier |
|---|---|---|---|---|
| App & Infrastructure hosts (traced) | Observability Cloud App & Infrastructure · per host-month · annual, billed annually | apm_hosts | ||
| Infrastructure hosts (untraced) | Observability Cloud Infrastructure · per host-month · annual, billed annually | hosts - apm_hosts | ||
| Custom metric series beyond 100 per host | Observability Cloud custom metrics beyond host entitlement · per custom-metric-series-month · contact sales | metric_series | 100 * hosts | |
| Logs in Splunk Cloud Platform (GB/day committed) | Splunk Cloud Platform ingest pricing · per custom · annual or multi-year | log_gb / (hours / 24) |
Example monthly bills
The same four illustrative workloads as the calculator, at list price. "At least" means a price the vendor does not state is left out of the total.
| Workload | Per month | Note | Calculator |
|---|---|---|---|
| Starter | ≥ $180 | At least; no stated price for Custom metric series beyond 100 per host, Logs in Splunk Cloud Platform (GB/day committed) | Open Starter in the calculator→ |
| Small | ≥ $375 | At least; no stated price for Custom metric series beyond 100 per host, Logs in Splunk Cloud Platform (GB/day committed) | Open Small in the calculator→ |
| Medium | ≥ $3,750 | At least; no stated price for Custom metric series beyond 100 per host, Logs in Splunk Cloud Platform (GB/day committed) | Open Medium in the calculator→ |
| Large | ≥ $37,500 | At least; no stated price for Custom metric series beyond 100 per host, Logs in Splunk Cloud Platform (GB/day committed) | Open Large in the calculator→ |
Capabilities
What Splunk (Cisco) offers, by the definitions in the dataset. Add-on means a separately priced product.
| Capability | Level | Sources |
|---|---|---|
| Ai assistant nl query Natural-language query or chat assistant | Yes | s13 |
| Ai root cause AI-assisted root-cause analysis or investigation agent | Yes | s14 |
| Alerting Alert rules with routing/notification | Yes | s14 |
| Byoc Vendor-managed in the customer's cloud account | No | s4 |
| Continuous profiling Continuous profiling | Yes | s1 |
| Data reduction Drop, aggregate, dedupe, or convert logs-to-metrics before billing | Yes | s12, s5 |
| Federated search Query data in place (object storage, other tools) without ingesting | Add-on | s10 |
| Fedramp FedRAMP authorized (state level in note) | Partial | s16, s19 |
| Hipaa HIPAA-eligible (BAA available) | Yes | s4 |
| Incident response Native on-call/incident workflow | Add-on | s2 |
| Llm observability LLM/agent tracing, token and cost tracking, evaluations | Add-on | s1, s15 |
| Logs Log management | Yes | s1 |
| Mcp server Exposes an MCP server for agents | Yes | s13 |
| Metrics Metrics | Yes | s1, s6 |
| Multi destination routing Route one stream to several third-party destinations | Partial | s12 |
| Open format archive Archive in an open format (Parquet, JSON, OTLP) in customer object storage | Partial | s11, s12 |
| Otel collector distro Ships or supports its own OpenTelemetry Collector distribution | Yes | s7 |
| Otlp ingest Accepts OTLP (gRPC or HTTP) natively, without a proprietary agent in the path | Yes | s7 |
| Pii redaction Mask/redact sensitive data in the pipeline | Yes | s12 |
| Pipeline processing Parse, enrich, transform in flight before storage | Yes | s12, s18 |
| Promql Query with PromQL (or a compatible dialect) | No | s4 |
| Proprietary agent required Full functionality needs the vendor's own agent (yes = lock-in signal) | No | s7 |
| Rbac Role-based access control | Yes | s13 |
| Rehydration Re-ingest archived data for search on demand | Yes | s11 |
| Rum Real-user monitoring (browser/mobile) | Partial | s1, s4 |
| Saas Vendor-hosted SaaS | Yes | s4 |
| Sampling tail Tail-based trace sampling | Partial | s23, s24, s25, s26 |
| Security siem SIEM or security analytics | Add-on | s2 |
| Self hosted Customer can run it on its own infrastructure | Partial | s17, s4 |
| Service map Auto-discovered service/topology map | Yes | s1 |
| Slo management First-class SLO/error-budget objects | Yes | s14 |
| Sql query SQL as a query language | No | s4 |
| Synthetics Synthetic monitoring | Yes | s1 |
| Tiered storage Hot/warm/cold or archive tiers priced differently | Yes | s11 |
| Traces Distributed tracing | Yes | s1, s6 |
| Usage cost controls Quotas, budgets, usage attribution to teams | Partial | s5, s8 |
Sources
Every page cited above, with the date it was read. Third-party pages are marked; a price stated only by a third party is shown as not stated.
Spotted a wrong price? A way to report one is not set up yet.