Splunk vs New Relic: Per-Host Observability Pricing Against Per-User and Per-GB
Prices and facts checked on vendor pages on Nov 8, 2026.
Splunk's observability line, Splunk Observability Cloud, prices by host and leans on Splunk Platform for log search. New Relic puts logs, traces, and infrastructure into one data meter and charges separately for the engineers who log in. Which model costs less depends on whether you have more hosts or more people.
The Short Answer
Pick Splunk when you already run Splunk Platform for logs or security and want Observability Cloud wired into it, or when you need an on-premises option for the log side. Pick New Relic when you want one meter for all telemetry, a free tier with 100 GB of ingest, and no per-host charge, and when the group needing full access is small.
Splunk vs New Relic at a Glance
How Splunk Charges
Per its pricing page, checked November 8, 2026, Splunk Observability Cloud has three tiers, each "starts at" and billed annually:
Database Monitoring and Secure Application are optional add-ons. The product page lists a free edition for up to 15 hosts. Log Observer Connect works on logs already stored in Splunk Platform, and Splunk lists that platform as activity-based, ingest, or workload pricing by quote. Splunk On-Call, its paging product, starts at $5 per user per month for up to 10 seats.
How New Relic Charges
The New Relic pricing page gives 100 GB of free ingest each month and $0.40 per GB after that, or $0.60 on Data Plus. Basic users cost nothing. Core users are $49. Full platform users are $10 for the first and $99 each after on Standard (five maximum), or $349 on Pro with an annual commitment and $418.80 pay as you go. The page says hosts, containers, and agents are unlimited at no extra cost.
Note one wrinkle in the free tier: once ingest passes 100 GB, it stops until you upgrade or the month turns over.
Two Worked Examples
Assumptions: 300 GB of telemetry a month on New Relic's original data option, Pro billed annually, no add-ons. The Splunk figures use the App & Infra tier and exclude any Splunk Platform charge for logs, because that price is quote-only.
Hosts push Splunk's bill up and people push New Relic's. The New Relic figure in the second row falls if some of those twelve can work as $49 core users, and the first row would be lower still on Standard.
Where They Differ in Practice
Where logs sit. In New Relic, logs arrive through its forwarder, Fluentd, Fluent Bit, Logstash, or a syslog TCP endpoint, and count against the same data meter as everything else. In Splunk Observability Cloud the logs experience is a connection to Splunk Platform, which carries its own contract. If you already own Splunk Platform, that is a feature. If you do not, it is a second purchase.
Retention and archives. New Relic documents 30 days by default and live archives that stretch to seven years, with separate storage and query billing. Splunk's pages reviewed here do not state retention, so ask for it in writing.
Tracing and sampling. Splunk markets NoSample tracing, which collects all traces. New Relic describes distributed tracing inside its APM capability. Check how each handles your traffic volume in a trial, since both bill on different units.
OpenTelemetry. New Relic accepts OTLP at documented endpoints in the US, EU, and Japan, and recommends OTLP over HTTP. Splunk documents its own distribution of the OpenTelemetry Collector for metrics, traces, and logs. Either way you can keep vendor-neutral instrumentation.
AI. Splunk describes an AI Assistant, native agents with human oversight, an MCP server, and an AI Canvas. New Relic's Autopilot needs the Pro or Enterprise edition plus the Advanced Compute add-on or a legacy compute plan, is capped at 100 requests per hour per organization, and suggests actions without carrying them out.
Security. Splunk also sells Enterprise Security with SIEM, and SOAR and UEBA in the Premier edition. The New Relic pages reviewed here do not describe a SIEM.
When to Pick Splunk
- Splunk Platform already holds your logs, and you want traces and metrics correlated with them.
- You need a SIEM, SOAR, and observability from one vendor.
- Your fleet is small in host count but staffed by many engineers who all need full access.
- You want a free edition capped by host count, up to 15 hosts.
When to Pick New Relic
- You want logs, APM, infrastructure, and browser monitoring on one bill with no per-host charge.
- Your fleet has many hosts or containers and few people needing deep access.
- A 100 GB monthly free tier, with 500 synthetic checks, is a useful starting point.
- You want live archives for long log retention, or Federated Logs to query logs in place.
Where Sazabi Fits
Sazabi is AI-native observability and security that runs beside either product. Add an otlphttp exporter to your Collector, as the Collector guide shows, and a copy of your logs goes to Sazabi while Splunk or New Relic keeps receiving theirs. The agent investigates and opens issues in Slack, and can route them to Splunk On-Call through the Splunk On-Call integration on the Startup and Growth plans.
For the one-to-one pages, see Sazabi vs Splunk and Sazabi vs New Relic. The Splunk alternatives and New Relic alternatives pages cover replacing either one, and Sazabi pricing lists plans.
Frequently Asked Questions
Does Splunk or New Relic charge per host?
Splunk Observability Cloud does, starting at $15, $60, or $75 per host per month billed annually, depending on tier. New Relic says it does not charge per host and prices by data ingested and by user type instead.
Where do logs live in each product?
New Relic stores logs in its own platform, with 100 GB a month free and $0.40 per GB after. Splunk Observability Cloud lists Log Observer Connect, which works on logs already stored in Splunk Platform, and Splunk Platform is priced by quote.
Is there a free tier for each?
Yes. New Relic includes 100 GB of ingest, one full platform user, and unlimited basic users each month. Splunk Observability Cloud has a free edition for up to 15 hosts.
Which one fits OpenTelemetry pipelines?
Both. New Relic ingests OTLP natively and recommends OTLP over HTTP. Splunk ships its own distribution of the OpenTelemetry Collector for Observability Cloud, and describes the product as OpenTelemetry-native.
Can the two run side by side during an evaluation?
Yes. An OpenTelemetry Collector can export the same telemetry to New Relic and to Splunk at once. Test both on the same traffic before you pick a pricing model.
Sources
- Observability Cloud per-host starting prices and tier contents, Splunk Platform pricing models, On-Call price, Enterprise Security editions (accessed Nov 8, 2026)
- Free edition for up to 15 hosts, logs from Splunk Platform in context, NoSample tracing, OpenTelemetry-native (accessed Nov 8, 2026)
- Splunk Distribution of the OpenTelemetry Collector for metrics, traces and logs (accessed Nov 8, 2026)
- Splunk AI Assistant, native agents, MCP server and AI Canvas (accessed Nov 8, 2026)
- Free tier, $0.40 and $0.60 per GB rates, user types and prices, no per-host charge, compute option (accessed Nov 8, 2026)
- Log forwarding routes, in-context logs and Federated Logs (accessed Nov 8, 2026)
- Default 30-day log retention and live archives up to seven years (accessed Nov 8, 2026)
- Autopilot availability, limits and Slack use (accessed Nov 8, 2026)
- Native OTLP ingest endpoints (accessed Nov 8, 2026)
- Sazabi plan prices, included usage and on-call integrations by plan (accessed Nov 8, 2026)
- Sazabi as an extra OTLP/HTTP exporter next to existing Collector exporters (accessed Nov 8, 2026)
- Sazabi routes issues to Splunk On-Call (accessed Nov 8, 2026)