Dynatrace vs Splunk: One Rate Card Against Four Pricing Models

Prices and facts checked on vendor pages on Nov 8, 2026.

Dynatrace and Splunk both sell full observability, but they come at it from opposite ends. Dynatrace is an agent-first platform with one rate card, built around automatic discovery and causal root cause analysis. Splunk is a search and data platform first, with Observability Cloud added for metrics, traces and APM.

The Short Answer

Pick Dynatrace when you want one vendor and one commitment for hosts, Kubernetes, application traces and logs, with the platform mapping dependencies for you. Pick Splunk when your organization already searches machine data in SPL, when security and IT teams share the same data, or when you need an on-premises deployment. Neither is a card-and-go decision at scale, because both sell on annual terms once the trial ends.

Dynatrace vs Splunk at a Glance

How Dynatrace Charges

These are list prices from Dynatrace's pricing page, checked on November 8, 2026. You make an annual commitment at the platform level, then every product draws down from it at rate-card prices. Dynatrace says it never charges penalty-style overages: usage above your commitment is billed monthly at the same rates, and a larger commitment lowers your unit price.

Hosts come in three tiers. Foundation & Discovery is $7 per host per month, Infrastructure Monitoring is $29, and Full-Stack Monitoring is $58 per 8 GiB host and adds APM, code-level profiling and Kubernetes Platform Monitoring. Telemetry is metered separately: logs, traces and events are $0.20 per GiB to ingest and process, metrics are $0.15 per 100,000 datapoints, and Pay-per-Query retention is $0.0007 per GiB-day with queries at $0.0035 per GiB scanned. Seats are unlimited at no extra charge.

Here is a worked log example. Assume 1,000 GiB ingested in a month, every GiB kept for 14 days, and 200 GiB scanned by queries.

Host fees are not included, and neither is the platform commitment itself.

How Splunk Charges

Splunk splits pricing by product. For Splunk Observability Cloud, the pricing page lists Infrastructure at $15 per host per month, App & Infra at $60, and End-to-End at $75, all billed annually. APM starts at the App & Infra tier, and Real User Monitoring and Synthetic Browser Monitoring start at End-to-End. Database Monitoring and Secure Application are optional add-ons with no listed price. Observability Cloud also has a free edition.

Splunk Platform, which holds the logs, uses a different menu: workload pricing (compute, measured in SVCs on Splunk Cloud Platform), ingest pricing (gigabytes ingested), activity-based pricing (a dual meter on ingest and search) and entity pricing (monitored hosts, containers and protected devices, available for Observability Cloud and AppDynamics). All of them are quote-only, so no per-GB number appears on the pages. Splunk's FAQ says it charges for overages only when you consistently exceed purchased ingestion or storage capacity, and that volume discounts exist for each plan.

Because the two vendors meter differently, a fair comparison starts with your host count and daily log volume, not with the headline prices. At 20 hosts, Dynatrace Full-Stack lists at 20 x $58 = $1,160 per month, and Splunk App & Infra lists at 20 x $60 = $1,200 per month on annual billing. Logs sit on top of both, and only Dynatrace's side is a published number.

Query, Storage and Retention Differences

Dynatrace stores logs, metrics and traces in Grail, a data lakehouse its docs describe as index-free and schema-on-read, so you decide what to query when you query, not when you ingest. Data is processed in OpenPipeline on the way in. DQL is the one language across all of it, and Notebooks and Dashboards are where you explore and chart the results.

Splunk's center of gravity is the Platform and SPL, with Observability Cloud layered on for metrics and traces. Observability Cloud lists Log Observer Connect in all three tiers, and Splunk positions it as bringing in logs from Splunk Platform. Observability Logs is a separate offering built on a Splunk Cloud stack, with 15 or 30 days of hot-tier retention and cold or frozen storage after that. On the APM side, Troubleshooting MetricSets are kept for 8 days by default, with 15 or 30 available through your account team, while Monitoring MetricSets are kept for 13 months.

If long retention is the deciding factor, Dynatrace publishes the wider range, up to 10 years on logs, traces and events. If you already have years of data and saved searches in Splunk Platform, the cost of moving it may outweigh any rate difference.

AI and Automation

Dynatrace Intelligence applies causal analysis over the Smartscape dependency graph, correlates deployments and configuration changes, and offers natural-language investigation. Agentic workflows are marked Preview in the docs. On the pricing page, AI Exploration is included, while autonomous multi-step investigations are metered at an average of 30 AI units per call.

Splunk's AI Assistant has an Agent Mode that chains multiple tools, validates its analysis at each step and generates or edits SPL from plain English. It sits on the Splunk Platform side, so it helps most if your data and searches already live there.

When to Pick Dynatrace

• You want automatic discovery of hosts, services and dependencies from an agent, with causal root cause analysis on top.
• You prefer a single published rate card and one annual commitment over separate quotes per product.
• You need log, trace or event retention beyond a few weeks, up to 10 years.
• Unlimited seats matter, because many people outside engineering need access.

When to Pick Splunk

• Your teams already write SPL, and security and IT operations share Splunk Platform data.
• You need an on-premises or private-cloud deployment through Splunk Enterprise.
• You want a free edition of Observability Cloud to start on.
• You can work with a quote-based contract and a choice of workload, ingest, activity or entity pricing.

Where Sazabi Fits

Sazabi is AI-native observability and security that can run beside either tool. If your logs already pass through an OpenTelemetry Collector, add Sazabi as an additional OTLP/HTTP exporter and leave your Dynatrace or Splunk exporter in place. Its agent investigates in Slack and opens issues you can hand to a coding agent. Plans are $50, $200 and $1,000 per 30 days, each with 200 GB of ingested logs included, per the Sazabi pricing page. For one-to-one views, read Sazabi vs Dynatrace and Sazabi vs Splunk, or browse Dynatrace alternatives and Splunk alternatives. The OpenTelemetry integration page covers setup.

Frequently Asked Questions

Is Dynatrace or Splunk cheaper?

Dynatrace publishes more of its price. Full-Stack Monitoring lists at $58 per 8 GiB host per month and logs at $0.20 per GiB ingested. Splunk Observability Cloud lists $15, $60 and $75 per host per month on annual billing, but Splunk Platform log pricing is quote-only, so a full comparison needs a Splunk quote.

Does Splunk or Dynatrace use a query language I need to learn?

Both. Dynatrace uses DQL on its Grail data lakehouse, and its AI features can translate natural language to DQL. Splunk Platform uses SPL, and its AI Assistant can turn plain English into SPL.

Which one keeps data longer?

Dynatrace Pay-per-Query lets you set log retention from 1 day to 10 years. Splunk Observability Cloud keeps APM Troubleshooting MetricSets for 8, 15 or 30 days and Monitoring MetricSets for 13 months, and Observability Logs lists 15 or 30 days of hot-tier retention. Splunk Platform retention depends on your plan and storage choices.

Can I run Dynatrace or Splunk on my own servers?

Splunk Enterprise runs in a private cloud or on-premises, including air-gapped environments. Dynatrace documents a self-managed option called Dynatrace Managed, alongside its SaaS platform.

Sources

1. Annual platform commitment, host rates, log, metric and trace rates, AI unit table, on-demand billing above commitment, unlimited seats (accessed Nov 8, 2026)
2. Log management on Grail with schema-on-read, DQL, OpenPipeline processing and OneAgent or API ingestion (accessed Nov 8, 2026)
3. Grail data lakehouse, no index, schema-on-read, unified logs, metrics and traces (accessed Nov 8, 2026)
4. Dynatrace Intelligence causal analysis, anomaly detection, natural-language investigation and agentic workflows (Preview) (accessed Nov 8, 2026)
5. Sending OTLP traces, metrics and logs to Dynatrace directly or through a Collector (accessed Nov 8, 2026)
6. Dynatrace Managed documentation for a self-managed cluster (accessed Nov 8, 2026)
7. Observability Cloud host-based tiers and what each includes, free edition, Splunk Platform pricing options, Cloud Flex (accessed Nov 8, 2026)
8. Workload (SVC), ingest, activity-based and entity pricing models and which products use each (accessed Nov 8, 2026)
9. Splunk overage policy and volume discounts (accessed Nov 8, 2026)
10. Observability Cloud retention for APM Troubleshooting MetricSets (8, 15 or 30 days), Monitoring MetricSets (13 months) and infrastructure metrics (accessed Nov 8, 2026)
11. Observability Logs hot-tier retention of 15 or 30 days, then cold or frozen storage, on a Splunk Cloud stack (accessed Nov 8, 2026)
12. Observability Cloud OpenTelemetry-native positioning, NoSample tracing and logs in context from Splunk Platform (accessed Nov 8, 2026)
13. Splunk Distribution of the OpenTelemetry Collector, based on the Contrib version, exporting metrics, traces and logs to Observability Cloud (accessed Nov 8, 2026)
14. Splunk AI Assistant with Agent Mode and natural language to SPL (accessed Nov 8, 2026)
15. Splunk Enterprise for on-premises and hybrid deployment (accessed Nov 8, 2026)
16. Sazabi plan prices, included usage and overage rates (accessed Nov 8, 2026)
17. Sazabi as an additional OTLP/HTTP exporter in an OpenTelemetry Collector (accessed Nov 8, 2026)