Datadog vs Splunk: Published Prices vs Quotes, Logs, SIEM, and Deployment
Prices and facts checked on vendor pages on Nov 8, 2026.
Splunk grew out of searching machine data and later added Observability Cloud for host-based monitoring and Enterprise Security for SIEM. Datadog started with infrastructure monitoring and added logs, security, and AI on one hosted account with public list prices. If you are choosing between them, the first question is whether logs and security are the center of your stack or one input to monitoring.
The Short Answer
Pick Splunk if you already run Splunk Platform or Enterprise Security, need an on-premises or air-gapped deployment, or want SPL and the Splunkbase app catalog. Pick Datadog if you want a single hosted account, published prices you can model without a sales call, and logs sitting next to APM and infrastructure by default. Both can send telemetry through OpenTelemetry, so the choice is mostly about where logs and security data live and how you want to buy.
Datadog vs Splunk at a Glance
How Datadog Charges
Datadog's list page is the easiest of the two to model. Annual rates checked Nov 8, 2026:
- Infrastructure Pro is $15 per host per month and APM is $31 per APM host. Monthly and on-demand rates are higher ($18 and $36).
- Logs are $0.10 per GB ingested. Indexed events cost $1.06, $1.27, $1.70, or $2.50 per million for 3, 7, 15, or 30 days of retention.
- Flex Logs Storage is $0.05 per million events stored, with query compute sold as a separate tier. Monitors and Watchdog do not run on Flex Logs.
- Cloud SIEM is $5 per million analyzed events. RUM Measure is $0.15 per 1,000 sessions on full traffic, and browser tests are $12 per 1,000 runs.
- AI Credits are $500 per 500 credits a month on an annual bundle, or $1.30 per credit on demand.
How Splunk Charges
Splunk sells through several pricing models, and only part of the catalog has a number on the page. Checked Nov 8, 2026:
- Observability Cloud: host-based entity pricing, from $15 (Infrastructure), $60 (App & Infra), or $75 (End-to-End) per host per month, billed annually. Infrastructure includes Log Observer Connect, Network Explorer, and uptime monitoring. App & Infra adds APM with Always On Profiling and API synthetics. End-to-End adds RUM and browser synthetics. Database Monitoring and Secure Application are optional add-ons.
- Splunk Cloud Platform: activity-based, ingest, or workload pricing with unlimited users, plus Cloud Flex to move spend between Splunk products.
- Splunk Enterprise: data-ingest or workload pricing for private cloud and on-prem.
- Enterprise Security: Essentials and Premier editions, priced by quote.
- Splunk On-Call: from $5 per user per month for up to 10 seats, billed annually.
What the Prices Look Like for 30 Hosts
Take 30 hosts with APM and about 1 TB of logs a month (1 billion events at 1 KB), kept 15 days. The sums use only the list prices above.
- Datadog hosts: 30 × ($15 + $31) = $1,380 a month.
- Splunk Observability Cloud hosts: 30 × $60 = $1,800 from the App & Infra tier, or 30 × $75 = $2,250 from End-to-End.
- Datadog logs, all indexed: $100 ingest + 1,000 × $1.70 = $1,800 a month. If you index 100 million events and keep the rest in Flex Logs Storage, it is $100 + $170 + 900 × $0.05 = $315, before Flex query compute.
- Splunk logs: no list price to add, because they sit in Splunk Platform and come by quote.
These are not like-for-like. Splunk's tiers bundle items Datadog bills separately, and Splunk's page does not state RUM session or synthetic test quotas, so End-to-End cannot be priced against Datadog's per-session and per-run meters. What you can say is that the Datadog side is complete on paper and the Splunk side is not.
Logs, SIEM, and Where Your Data Lives
Splunk's center of gravity is the data platform. Observability Cloud correlates metrics and traces with logs "already stored in Splunk Platform", which suits teams that have years of Splunk indexes and SPL searches. Splunk Cloud Platform is managed by Splunk, and Splunk Enterprise can sit entirely inside your network.
Datadog keeps logs in the same hosted account as APM and infrastructure. For cost control it offers exclusion filters, archives that forward all ingested logs to your own cloud storage with rehydration, Flex Logs for long retention, and BYOC Logs if you want log storage in your own object storage. Cloud SIEM runs on top of Log Management, so security logs can use standard indexing or Flex Logs.
For security teams the difference is scope. Splunk Enterprise Security bundles SIEM, SOAR in the Premier edition, UEBA, and threat intelligence from Cisco Talos. Datadog Cloud SIEM is priced per analyzed event and sits beside the rest of the Datadog account. If SOAR and a deep detection-engineering workflow are requirements, look at Splunk first.
AI and OpenTelemetry
Splunk's AI Assistant helps with investigations, its Cloud Platform AI Assistant app turns natural language into SPL, and an MCP server coordinates agent workflows across data sources. Datadog bills Bits Chat and Bits Investigation in AI Credits, with Bits Investigation averaging about 4 credits per autonomous run, roughly $4 on an annual bundle.
On OpenTelemetry both are open. Splunk ships its own Collector distribution that exports metrics, traces, and logs to Observability Cloud. Datadog's Agent can embed the DDOT Collector, or you can point a standard Collector or OTLP exporter at Datadog directly.
When to Pick Datadog
- You want to model costs from a public price list and change plans month to month.
- You have no Splunk footprint and want logs, APM, and infrastructure in one hosted account.
- You prefer to tune log spend with exclusion filters, Flex Logs, and archives you control.
- You want a SIEM priced per analyzed event rather than by quote.
When to Pick Splunk
- You already run Splunk Platform or Enterprise Security and your team writes SPL.
- You need an on-premises, private cloud, or air-gapped deployment.
- You need a SOAR and UEBA bundle alongside a SIEM.
- You want to try Observability Cloud free on up to 15 hosts before talking to sales.
- You want the Splunkbase catalog of more than 1,200 apps and add-ons.
Where Sazabi Fits
Sazabi is AI-native observability and security that can sit beside Datadog or Splunk without replacing either. If an OpenTelemetry Collector already feeds them, add an otlphttp exporter that sends Sazabi a copy of your logs. Sazabi's agent investigates in Slack and opens issues, and it can route those issues to Splunk On-Call. For a one-on-one view, read Sazabi vs Datadog and Sazabi vs Splunk, or browse the Splunk alternatives, the Datadog alternatives, and Sazabi pricing.
Related head-to-heads: Datadog vs Dynatrace, Datadog vs New Relic, Dynatrace vs Splunk, and Splunk vs New Relic.
Frequently Asked Questions
Does Splunk publish prices the way Datadog does?
Only in part. Splunk Observability Cloud lists starting prices of $15, $60, and $75 per host per month, billed annually, with a quote required. Splunk Platform and Enterprise Security use activity-based, ingest, or workload pricing that you get by contacting sales. Datadog publishes annual, monthly, and on-demand rates for each product on its list prices page.
Where do logs live in Splunk Observability Cloud?
Splunk describes logs in Observability Cloud as logs already stored in Splunk Platform, reached through Log Observer Connect, which is included in all three tiers. Log storage and search are therefore priced under Splunk Platform, not the per-host Observability Cloud tiers. In Datadog, logs are a product on the same account, priced at $0.10 per GB ingested plus indexing or Flex Logs storage.
Can I run Splunk on-premises or air-gapped?
Yes. Splunk Enterprise is sold for private cloud and on-premises use, including air-gapped environments, on ingest or workload pricing. Splunk Cloud Platform is the Splunk-managed version. Datadog runs from its hosted sites, with BYOC Logs available if you need log storage in your own cloud object storage.
How do Datadog Cloud SIEM and Splunk Enterprise Security compare on price?
Datadog Cloud SIEM lists at $5 per million analyzed events a month on annual terms ($6 monthly, $7.50 on demand). Splunk Enterprise Security has Essentials and Premier editions with quote-based pricing, so there is no published figure to compare against.
Does Splunk support OpenTelemetry?
Yes. Splunk positions Observability Cloud as OpenTelemetry-native and ships the Splunk Distribution of the OpenTelemetry Collector for metrics, traces, and logs. Datadog accepts OTLP through the DDOT Collector, a standard OpenTelemetry Collector, or direct OTLP ingestion.
Sources
- Infrastructure Pro, APM, log ingestion and indexing, Flex Logs Storage, Cloud SIEM, RUM, and browser test list prices (accessed Nov 8, 2026)
- Free tier of five Basic hosts with 1-day metric retention, free trial, AI Credit bundles, and monthly or hourly billing options (accessed Nov 8, 2026)
- Cloud SIEM runs on Datadog Log Management and offers standard indexing or Flex Logs for security logs (accessed Nov 8, 2026)
- Flex Logs separates storage from query compute; monitors and Watchdog are not supported in Flex Logs (accessed Nov 8, 2026)
- Log indexes and exclusion filters that discard logs from indexing while keeping them available for archiving and metrics (accessed Nov 8, 2026)
- Forwarding all ingested logs to your own cloud storage, with rehydration and archive search (accessed Nov 8, 2026)
- BYOC Logs runs in your own infrastructure and stores logs in your object storage (accessed Nov 8, 2026)
- DDOT Collector, OpenTelemetry Collector export, and direct OTLP ingestion into Datadog (accessed Nov 8, 2026)
- Observability Cloud tiers and starting prices, quote-based Platform and Security pricing models, Enterprise on-prem and air-gapped deployment, On-Call price (accessed Nov 8, 2026)
- Free edition for up to 15 hosts, OpenTelemetry-native positioning, NoSample tracing, logs already stored in Splunk Platform (accessed Nov 8, 2026)
- Splunk-managed Cloud Platform, 14-day trial, SPL, Splunk AI Assistant app, and the Splunkbase app catalog (accessed Nov 8, 2026)
- Splunk Enterprise for on-premises and hybrid deployments (accessed Nov 8, 2026)
- Splunk AI Assistant, MCP server, and AI Canvas (accessed Nov 8, 2026)
- Splunk Distribution of the OpenTelemetry Collector exports metrics, traces, and logs to Observability Cloud (accessed Nov 8, 2026)
- Sazabi plan prices, included usage, and per-GB overage rates (accessed Nov 8, 2026)
- Adding a Sazabi OTLP exporter beside existing Collector exporters (accessed Nov 8, 2026)
- Routing Sazabi issues to Splunk On-Call incidents (accessed Nov 8, 2026)