Elastic vs Splunk: Published Rates, Deployment and AI Compared
Prices and facts checked on vendor pages on Nov 8, 2026.
Elastic and Splunk both sell search over machine data, and both stretch from logs into security and observability. Elastic grew out of an open source search engine and publishes its serverless rates, so you can price it from a web page. Splunk sells several products under one name and asks you to talk to sales for most of them.
The Short Answer
Pick Elastic if you want published per-GB rates, a self-managed option under open source licenses, or one engine for search, logs and security. Pick Splunk if your security team already lives in Splunk Enterprise Security, you need an air-gapped deployment with vendor support, or your organization has years of SPL searches to keep. If neither describes you, request a Splunk quote on your real volume and set it beside an Elastic estimate before deciding.
Elastic vs Splunk at a Glance
How Elastic Charges
Elastic's serverless pricing pages, read on Nov 8, 2026, bill what you send and what you keep. Observability Logs Essentials lists ingest as low as $0.07 per GB and retention as low as $0.017 per GB per month. Complete lists as low as $0.09 and $0.019 for logs and traces, with metrics at $0.023 ingest and $0.005 retention. Egress is free up to 50 GB a month, then $0.05 per GB.
Elastic Security Serverless is priced the same way: Essentials from $0.09 ingest and $0.017 retention, Complete from $0.11 and $0.019. Elastic says per-endpoint fees stopped applying on March 23, 2026.
Add-ons on Complete projects are metered separately: the Elastic Managed LLM at $4.50 per million input tokens and $21 per million output tokens, and Agent Builder at as low as $0.025 per execution after 10,000 free. Support above the included Standard level costs 5%, 10% or 15% of your consumption.
Worked example, using only those list prices: 500 GB ingested and kept for one month, logs only, no egress charge. Logs Essentials is 500 x $0.07 + 500 x $0.017 = $43.50. Complete is 500 x $0.09 + 500 x $0.019 = $54.50. Both rates are "as low as" floors, so treat the result as a lower bound.
How Splunk Charges
Splunk's pricing page is organized by product, and most entries end in "Get a quote." Its pricing models page describes four models:
- Workload: priced on compute and storage for search and analytics, measured in Splunk Virtual Compute units on Cloud Platform and vCPUs on Enterprise.
- Ingest: priced on gigabytes ingested, with more users and searches at no extra charge.
- Activity-based: a dual-meter model on both ingest and search activity, available for Splunk Cloud Platform.
- Entity: priced on monitored hosts, containers and protected devices, for Observability Cloud and AppDynamics.
Observability Cloud is the one line with public numbers, as list prices on Nov 8, 2026: Infrastructure from $15, App & Infra from $60, and End-to-End from $75 per host per month, all billed annually. For 15 hosts that is $225, $900 and $1,125 per month at the starting prices. None of that is a log price, because Splunk does not list one. Splunk also lists Cloud Flex for moving spend between products without restarting procurement.
Where They Differ in Practice
Who sets the price. With Elastic you can build an estimate yourself and check it against your bill. With Splunk you negotiate a model, and the model you choose (ingest, workload or activity) changes what you pay for the same data. That flexibility suits large, predictable estates. It is slower going if you want a number today.
Query language. Elastic's ES|QL is a piped language, and Kibana Discover also accepts KQL and Lucene. Splunk searches in SPL, its Search Processing Language, and its AI Assistant app translates natural language into SPL. If your analysts already write SPL, that skill is the main switching cost.
Licensing. Elastic states that the Elasticsearch and Kibana source is available under SSPL, Elastic License 2.0 or AGPLv3, and that its default distribution ships under Elastic License 2.0. A legal team will want that on file if you plan to self-manage or embed it.
Security scope. Both sell a SIEM. Splunk Enterprise Security lists UEBA, threat intelligence and, in Premier, SOAR. Elastic Security covers SIEM, XDR, endpoint and cloud security and prices it per GB. Detection content and response automation are where the products differ most, and neither pricing page settles that.
AI. Elastic's docs mark the Observability AI Assistant deprecated and make the Elastic AI Agent the default chat. Agent Builder lets you define agents and tools over Elasticsearch data and exposes them through an MCP server. Splunk's MCP Server lets outside assistants such as Claude or ChatGPT work with Splunk platform data under your Splunk access controls.
When to Pick Elastic
- You want to estimate cost from published per-GB rates.
- You need to run on your own infrastructure under open source licenses.
- The same data should serve search, logs and security work.
- You are comfortable owning index and pipeline design.
When to Pick Splunk
- Your security operations already run on Splunk Enterprise Security.
- You need an air-gapped deployment from a single vendor.
- Your team's SPL searches and dashboards are worth keeping.
- You prefer a negotiated contract with unlimited users.
Where Sazabi Fits
Sazabi is AI-native observability and security that can run beside either tool. If your logs already pass through an OpenTelemetry Collector, you can add Sazabi as one more exporter and leave Elastic or Splunk untouched. Its agent investigates what it finds in Slack and opens issues you can hand to a coding agent. Sazabi ingests OpenTelemetry metrics (Prometheus metrics through an OpenTelemetry Collector) and OTLP traces through the same intake as your logs. It stores each metric data point and each span as a log record that its agent queries alongside your logs, so there is no separate metrics store to run. Sazabi is not a SIEM. For one-to-one views, read Sazabi vs Elastic and Sazabi vs Splunk, or browse Elastic alternatives and Splunk alternatives. Sazabi's plans are on the pricing page, and Sazabi and OpenTelemetry shows the collector setup.
Frequently Asked Questions
Is Splunk or Elastic cheaper for logs?
Only Elastic publishes per-GB rates. Observability Serverless lists ingest as low as $0.07 to $0.09 per GB and retention as low as $0.017 to $0.019 per GB per month. Splunk lists no per-GB log price and asks for a quote, so a real comparison needs a Splunk quote for your volume.
Is the ELK stack the same thing as Elastic Observability?
ELK is shorthand for Elasticsearch, Logstash and Kibana. Elastic now describes the Elastic Stack as Elasticsearch and Kibana plus components such as Elastic Agent and Logstash, and sells Observability as a solution on top of it.
Can Elastic replace Splunk Enterprise Security?
Elastic Security is its SIEM, endpoint and cloud security product, priced per GB on Serverless. Splunk Enterprise Security lists SIEM, UEBA, threat intelligence and, in the Premier edition, SOAR. Compare detection content, response automation and your team's existing workflows before moving.
Which one can run fully on-premises?
Both. Elastic documents self-managed installs, Elastic Cloud Enterprise and Elastic Cloud on Kubernetes. Splunk Enterprise deploys in a private cloud or on-prem, including air-gapped environments.
Can I send the same logs to Elastic, Splunk and Sazabi?
Yes, if you collect them with an OpenTelemetry Collector. Add Sazabi as one more OTLP/HTTP exporter beside the Elastic and Splunk ones, so each keeps receiving the same stream.
Sources
- Observability Serverless tiers, per-GB ingest and retention rates, egress, add-on prices and support percentages (accessed Nov 8, 2026)
- Security Serverless Essentials and Complete tiers, ingest and retention rates, and the end of per-endpoint fees (accessed Nov 8, 2026)
- Elastic Security as SIEM, XDR, endpoint and cloud security in one solution (accessed Nov 8, 2026)
- Elastic deployment options: Cloud Serverless, Cloud Hosted, self-managed, Elastic Cloud Enterprise and Elastic Cloud on Kubernetes (accessed Nov 8, 2026)
- The Elastic Stack (ELK) as Elasticsearch and Kibana plus Elastic Agent, Logstash and other components (accessed Nov 8, 2026)
- Elasticsearch and Kibana source licenses: SSPL, Elastic License 2.0 and the AGPLv3 option (accessed Nov 8, 2026)
- ES|QL is a piped query language for filtering, transforming and analyzing data (accessed Nov 8, 2026)
- Kibana Discover searches with KQL, Lucene or ES|QL (accessed Nov 8, 2026)
- Agent Builder, custom tools, MCP server and A2A server (accessed Nov 8, 2026)
- AI Assistant deprecation notice and the Elastic AI Agent as the default chat experience (accessed Nov 8, 2026)
- Elastic Distributions of OpenTelemetry, the embedded OTel Collector in Elastic Agent and OTLP ingest paths (accessed Nov 8, 2026)
- Splunk product pricing: Cloud Platform, Enterprise, Enterprise Security editions, Observability Cloud host-based starting prices, Cloud Flex, quote-based Platform pricing (accessed Nov 8, 2026)
- Workload, ingest, activity-based and entity pricing models and which products use each (accessed Nov 8, 2026)
- Splunk Enterprise for on-premises and hybrid use, dashboards and Splunk AI apps (accessed Nov 8, 2026)
- Splunk-managed Cloud Platform, federated search, and the AI Assistant app that turns natural language into SPL (accessed Nov 8, 2026)
- Splunk MCP Server connecting AI assistants and agents to Splunk platform data (accessed Nov 8, 2026)
- Splunk Distribution of the OpenTelemetry Collector is a distribution of the upstream Collector (accessed Nov 8, 2026)
- Sazabi plan prices, included usage and overage rates (accessed Nov 8, 2026)
- Sazabi as an additional OTLP/HTTP exporter in an OpenTelemetry Collector (accessed Nov 8, 2026)