Splunk Pricing and Key Features Overview for 2026

Splunk publishes prices for its observability products in October 2026, starting at $15 per host per month for Splunk Observability Cloud. Splunk Cloud Platform, Splunk Enterprise, and Splunk Enterprise Security are sold by quote, under four pricing models: activity-based, workload, ingest, and entity.

This guide shows what each Splunk product costs where a price is published, which model each product can use, what Splunk Free includes, and the costs that sit outside the license.

Disclaimer: the figures below come from Splunk’s own pricing pages and documentation, read in October 2026. Splunk prices its platform and security products by quote, so treat every figure here as a starting point for that conversation.

Splunk bills grow with ingest volume, retention, and search load, and a bigger bill does not buy anyone to read the alerts at 2 a.m. UnderDefense Agentic AI SOC works on top of the Splunk you already run: AI agents investigate each alert, and analysts on shift 24/7 decide what happens next.

How Much Does Splunk Cost?

Splunk publishes no price for Splunk Cloud Platform, Splunk Enterprise, or Splunk Enterprise Security. Every one of them leads to “Get a quote” on Splunk’s pricing page, and the AWS Marketplace listing for Splunk Cloud also asks you to request a private offer. The published figures belong to the observability side of the portfolio.

The quote for the SIEM side depends on how much data you bring in, how often you search it, and which edition of Enterprise Security you need. The next sections explain each of those levers, so you can check a quote line by line.

Splunk Pricing Models: Activity-Based, Workload, Ingest, and Entity

Splunk now offers four pricing models, and the one you choose changes what the bill measures. Its pricing models page describes them as follows, read in October 2026.

Splunk positions activity-based pricing for complex, unpredictable workloads, and workload pricing for data you store but search rarely. Ingest pricing suits teams whose data volume tracks the value they get from it.

Splunk Ingest Pricing

Ingest pricing charges by the gigabytes of data you ingest into Splunk per day. Splunk says you can add users and increase search and analysis activity at no additional cost under this model, so the daily volume is the number that drives the quote.

Two details change the volume you pay for. Eligible Cisco telemetry counts at a 0.5x weighted ingest rate on Splunk Cloud Platform, and Splunk says it charges for overages only when you consistently exceed your purchased ingestion or storage capacity.

Workload Pricing and SVCs

Workload pricing charges for the compute behind your searches. Splunk Cloud Platform measures it in Splunk Virtual Compute (SVC) units, a unit of cloud compute, memory, and I/O, and Splunk Enterprise measures it in vCPUs.

Splunk’s workload calculator sizes SVCs from your daily gigabytes and a workload type, from Compliance Storage at 1,000 daily searches to Continuous Monitoring at 300,000. Splunk labels the result an estimate that can change with your use cases and your indexer and search head mix.

Splunk License Cost: Term Licenses and Subscriptions

Splunk sells cloud products as annual subscriptions and on-premises products as term licenses, under both ingest and workload pricing. Entity pricing for Splunk Observability Cloud is also an annual subscription.

Splunk states that there are no explicit limits on usage or on the number of users at one organization. Your license sets the capacity thresholds instead, such as daily ingest or compute, so the license cost follows the capacity you commit to.

Splunk Packages Overview

Splunk sells its SIEM as a platform plus a security layer. Splunk Cloud Platform and Splunk Enterprise collect, index, and search the data; Splunk Enterprise Security adds the security operations features on either of them.

Splunk SOAR and Splunk Attack Analyzer, which automates phishing and malware analysis, are also sold as dedicated products by quote. Cloud Flex lets you reallocate spend across the Splunk portfolio without restarting procurement.

Splunk Cloud Platform

Splunk Cloud Platform is the Splunk-managed SaaS version of Splunk, for organizations that want scale without running the infrastructure. You choose activity-based, ingest, or workload pricing, and every option includes unlimited users. Splunk offers a free trial.

Features of Splunk Cloud Platform:

Splunk Cloud Platform runs the same search and analytics engine as Splunk Enterprise, with Splunk operating the infrastructure. Its main features are:

• Elastic infrastructure that handles fluctuating data volumes during peak loads.
• Resilient cloud architecture that maintains uptime and service reliability.
• Machine learning that detects anomalies and surfaces hidden threats.
• Cross-referencing of multiple data sources to identify complex attack patterns.
• Centralized dashboards with a timeline of events, affected assets, and response recommendations.

The platform license covers all of the above; the security operations features covered below need Splunk Enterprise Security on top.

Pros of Splunk Cloud Platform:

The advantages are mostly operational, because Splunk carries the infrastructure work:

• Scales with growing data volumes.
• Less infrastructure to manage.
• Faster deployment and updates.

The trade-off sits in the cons below.

Cons of Splunk Cloud Platform:

Two limitations come up most often:

• Depends on internet connectivity.
• Costs can climb with extensive workloads.

The cost-control steps later in this guide address the second point directly.

Splunk Enterprise

Splunk Enterprise is the self-managed version for private cloud and on-premises environments, including air-gapped ones. It is priced on ingest or workload, with unlimited users, and comes with a 60-day free trial. It is the foundation for log management and basic SIEM use, with Splunk Enterprise Security added for advanced security operations.

Features of Splunk Enterprise:

Splunk Enterprise gives you the full search platform on infrastructure you control. Its main features are:

• Centralized storage and management of machine data from diverse sources.
• Real-time visibility into system and application activity.
• Splunk Processing Language (SPL) for complex queries and data analysis.
• Visual dashboards and tailored reports for monitoring.
• Configurable alerts for specific thresholds or anomalies.
• Compatibility with a wide range of data sources and systems.

Every one of these runs on hardware you size and operate, which is where the hidden costs section of this guide starts.

Pros of Splunk Enterprise:

The strengths of Splunk Enterprise come from its flexibility and its large user base:

• Manages and analyzes very large data volumes efficiently.
• Custom dashboards, alerts, and workflows for your own needs.
• Scales with growing data volumes on-premises.
• A large user base and extensive documentation for troubleshooting.
• A wide range of add-ons and third-party integrations.

The cons below are the other side of running it yourself.

Cons of Splunk Enterprise:

Running Splunk Enterprise well takes budget and specialist skills:

• Licensing and operational costs can be substantial at scale.
• Needs skilled people for configuration, tuning, and maintenance.
• Requires investment in storage and compute infrastructure.
• Advanced SIEM features such as threat intelligence management need Splunk Enterprise Security.
• SPL has a learning curve for teams without Splunk experience.

If your team is small, weigh these against the operational savings of Splunk Cloud Platform.

Splunk Enterprise Security

Splunk Enterprise Security (ES) is Splunk’s SIEM for security operations, and it runs on Splunk Cloud Platform, Splunk Enterprise, or a combination of both. It comes in two editions, Essentials and Premier, both by quote, priced on activity-based, workload, or ingest models.

Splunk Enterprise Security Editions: Essentials vs Premier

The two editions share the SIEM core and differ in automation and behavior analytics. The table follows the capability marks on Splunk’s pricing page in October 2026.

If you need SOAR or UEBA, price Premier from the start: both are Premier-only, and SOAR is otherwise a separate purchase.

Features of Splunk Enterprise Security:

Splunk Enterprise Security brings security-specific tooling on top of the Splunk platform. Its main features are:

• Dashboards and reports built for security use cases.
• Pre-built correlation rules and alerts for threat detection.
• Incident review and workflow management.
• Integration of third-party threat intelligence feeds.
• Frameworks for compliance, incident management, and real-time monitoring.
• Event timelines that show multi-stage attacks.
• Business context added to alerts, so the riskiest assets surface first.

Correlation rules still need tuning to your environment before the alerts they raise are worth an analyst’s time.

Pros of Splunk Enterprise Security:

The two strengths buyers cite most are control and flexibility:

• Complete control over data and infrastructure in self-managed deployments.
• Configuration tailored to specific requirements.

Both matter most to teams with strict data residency or sovereignty rules.

Cons of Splunk Enterprise Security:

The same control brings two costs:

• Needs dedicated IT resources for maintenance in self-managed deployments.
• Higher upfront costs.

Factor both into the total cost of ownership, alongside the license.

Splunk Free vs Splunk Enterprise: What the Free License Covers

Splunk Free is a free license for Splunk Enterprise that never expires and lets you index up to 500 MB of data per day. It is built for practice and small, standalone use, and Splunk’s documentation lists the features it removes. Every new Splunk Enterprise install starts on a 60-day Enterprise Trial, and you can switch to the Free license at any point.

Splunk Free also blocks searching after 3 license warnings in a rolling 30-day window, while it keeps indexing your data. That makes it unsuitable for anything a team relies on to catch an incident.

Which Option Fits Your Data Volume

Splunk’s own documentation gives the numbers for three common situations:

1. A lab or training setup under 500 MB per day runs on Splunk Free and uses around 7 GB of storage per month.
2. A one-off forensic review of a larger dataset also fits Splunk Free, which allows bulk loads over 500 MB up to 2 times in 30 days.
3. Production security monitoring needs alerts and user accounts, so it needs a paid license.

For anything in the third group, the decision is between Splunk Cloud Platform and Splunk Enterprise, and the pricing model under each.

Splunk Observability Pricing

Splunk publishes starting prices for most of its observability products, usually per host and billed annually. Splunk Observability Cloud correlates metrics, traces, and logs; AppDynamics covers hybrid and on-premises application performance.

All three Observability Cloud tiers include network explorer and synthetic uptime monitoring, and database monitoring and Secure Application are optional add-ons priced by quote. Observability Cloud also has a free edition.

AppDynamics add-ons are priced per unit, for example Application Security at $13.75 per CPU core per month. Splunk IT Service Intelligence uses workload or ingest pricing by quote, Splunk On-Call starts at $5 per user per month for up to 10 seats, and Splunk Agent Observability starts at $100 per month per 1.2 million spans.

Hidden Costs of Splunk

The license is only part of a Splunk budget. These costs appear on Splunk’s own pages or follow directly from the deployment you choose, and each one is worth a line in your business case:

• With Splunk Enterprise, you buy and run the storage and compute yourself.
• Changing use cases and the indexer to search head mix can move the SVC estimate.
• Standard support is included, and premium support is an extra purchase.
• SOAR, UEBA, and automated threat analysis require the Premier edition.
• Overages apply when you consistently exceed purchased ingest or storage.
• Implementation takes SPL skills, data onboarding, and correlation rule tuning.

The last item is usually the largest. Splunk Enterprise needs skilled people for configuration and maintenance, and an alert that nobody investigates costs the same license as one that stops an incident.

How to Negotiate Splunk Pricing and Cut Costs

Splunk’s own pricing FAQ names the levers it is willing to move, and a prepared buyer can use each of them. Work through these steps before the first pricing call:

1. Measure your daily ingest and search load for 30 days, so the quote rests on your data.
2. Run Splunk’s workload calculator and compare workload pricing with an ingest quote.
3. Filter and route data with Ingest and Edge Processors before it is indexed.
4. Keep rarely searched data in Amazon S3 and query it with Federated Search.
5. Ask for the volume discount, which Splunk says is available on every plan.
6. Count eligible Cisco telemetry at the 0.5x weighted ingest rate.
7. Get the overage trigger and the Cloud Flex reallocation terms in writing.

Each step either lowers the volume you pay for or removes uncertainty from the renewal. The overage terms matter most, because “consistently exceed” is Splunk’s phrase, and your contract should define it.

How Can UnderDefense Help You Maximize Splunk Productivity and Outcomes?

If you own Splunk and nobody is on shift at 2 a.m., your license pays for alerts that wait until morning. UnderDefense Agentic AI SOC works on top of Splunk without replacing it: AI agents investigate every alert, and UnderDefense analysts make the response decisions around the clock.

In one published case, UnderDefense replaced over 900 ineffective and noisy detection rules with 100+ personalized rules, and the team went from 100 false positives a day to 30 critical alerts. Expect detection tuning to take from a few weeks to a few months, as reviewers report.

Running Splunk without a night shift? Book a Splunk triage demo

Frequently Asked Questions