Splunk Pricing Explained: Ingest, Workload, Activity and Host Models
Prices checked on vendor pages on Nov 8, 2026.
Prices below come from Splunk's public pricing page and documentation, read on November 8, 2026. Splunk's biggest products are quote-only, so this guide explains how the models work and gives exact numbers only where Splunk publishes them.
Splunk sells a platform for logs and search, a security suite, and observability products, and each uses a different meter. The first question on any Splunk budget is which pricing model your quote uses, because the same data can cost very different amounts under each one.
The Short Version
- Splunk Cloud Platform and Splunk Enterprise have no list prices. You request a quote.
- Splunk Observability Cloud lists starting prices of $15, $60 and $75 per host per month, billed annually.
- Splunk offers four models: ingest, workload, activity-based and entity (host-based).
- Splunk says it charges overages only when you consistently exceed your purchased capacity.
- For Observability Cloud host plans, the docs say overage fees can reach 150% of the monthly list price.
The Four Pricing Models
Splunk's pricing models page defines each one:
Splunk describes ingest pricing as a fit when your data strategy follows data value, and workload pricing as a fit when you store a lot of data that you search rarely. Activity-based pricing is described as a fit for complex or unpredictable workloads.
What an SVC Is
A Splunk Virtual Compute unit is a bundle of compute, memory and I/O. Splunk's Lantern guide says the number you buy is the maximum compute you expect to need at peak, so you purchase a fixed capacity. The same guide says you are charged on anticipated workloads rather than data volume ingested, and that you can see hourly SVC use in the Cloud Monitoring Console.
That makes workload pricing hard to estimate without a trial. Search volume and complexity drive SVCs along with daily indexing volume, so two companies with the same daily GB can need different capacity.
Prices Splunk Publishes
These are "starting at" figures from Splunk's pricing page, billed annually. A quote can come in higher or lower.
Splunk lists these editions for Observability Cloud:
- Infrastructure: Infrastructure Monitoring, Log Observer Connect, Network Explorer and synthetic uptime monitoring.
- App & Infra: Adds APM with Always On Profiling and synthetic API monitoring.
- End-to-End: Adds Real User Monitoring and synthetic browser monitoring.
Database Monitoring and Secure Application are optional add-ons with no public price. AppDynamics add-ons list Application Security at $13.75 per CPU core per month and Real User Monitoring at $0.06 per 1,000 tokens per month.
How Overages Work
Splunk's pricing FAQ says it charges for overages "only when you consistently exceed" purchased data ingestion or storage capacity, and that you can go above your subscription during critical incidents. You can adjust allocation through the Splunk Support Portal.
For Observability Cloud host plans, the docs add detail:
- Hosts and containers are counted per hour and averaged over the month.
- Overage fees apply to each type of object separately. Going over on hosts does not raise your container limit.
- Overage fees can be as high as 150% of the monthly list price for each element over your limit.
- Host and container metrics are covered by the plan. Custom metrics have entitlements of 100 time series per host on Standard and 200 per host on Enterprise, with extra series charged separately.
Archived metrics count at one tenth of real-time metrics, and one histogram data point counts as 8 metric time series.
A Worked Example for Hosts
Take 30 hosts on Observability Cloud at the published starting prices, billed annually:
On the Enterprise edition, 30 hosts also carry a custom metric entitlement of 6,000 time series (30 x 200). Anything above that is billed per series at a rate Splunk does not publish. If your average host count drifts to 35 in a month, you pay overage on 5 hosts at up to 150% of list, not on the whole fleet.
We cannot give a Splunk Cloud Platform example. There is no public per-GB, per-SVC or activity-based rate to multiply.
What Splunk Says About Cost Controls
The pricing page lists a few tools that act before data is indexed or stored:
- Ingest Processor and Edge Processor filter, redact and route data, so less reaches storage.
- Federated Search queries data where it lives, such as Amazon S3, instead of copying it.
- Access tokens and alerts track usage and flag spikes. On Observability Cloud Enterprise, you can set limits on access tokens.
- Cloud Flex lets you reallocate spend across Splunk products without restarting procurement.
The page also says Splunk Cloud Platform counts eligible Cisco telemetry at a 0.5x weighted ingest rate.
Where Sazabi Compares
Sazabi is AI-native observability and security, focused on logs. Because Splunk Cloud Platform has no public price, we cannot put its log costs next to ours in a table, and we will not guess. We wrote this page, so we are a party to the comparison.
What we can state is how Sazabi charges. It does not bill per host or per user. Each plan sets a member limit (2 on Hobby, 15 on Startup, 45 on Growth), then charges $0.10 per GB ingested and $0.10 per GB scanned by searches, after the plan's included amounts of 200 GB ingested and 50 GB scanned per 30-day cycle. Startup is $200 per 30 days with 30-day retention, and Growth is $1,000 with 90-day retention. Issues are $4 each after 20 included per cycle. The details are on our pricing page.
Splunk's search-based and capacity-based models resemble a mix of Sazabi's two meters, but the units differ. Sazabi scans are metered in GB, while Splunk Cloud meters SVCs. To compare for your case, ask Splunk for a quote at your daily ingest and search load, then price the same volume with our published list prices. If your logs run through an OpenTelemetry Collector, you can add Sazabi as another exporter and run both for a trial period.
When Splunk Is Worth the Price
Splunk is a large platform with search, security and observability under one contract. If you have a security operations team, an existing Splunk Enterprise deployment, air-gapped environments, or a need for Cloud Flex style budget sharing across many products, the quote process may be worth it. Splunk says it supports private cloud and on-prem deployments, which a hosted-only product does not.
If your need is mostly application logs and a few engineers searching them, a published per-GB price is easier to plan around. See our Sazabi and Splunk comparison and the Splunk alternatives page. For other vendors, our Datadog pricing guide and New Relic pricing guide cover their models.
Frequently Asked Questions
How much does Splunk cost?
It depends on the product. Splunk Cloud Platform and Splunk Enterprise are quote-only. Splunk Observability Cloud lists starting prices of $15, $60 and $75 per host per month, billed annually.
What is the difference between Splunk ingest and workload pricing?
Ingest pricing is based on gigabytes of data ingested. Workload pricing is based on compute and storage resources used to run searches and analytics, measured in Splunk Virtual Compute (SVC) units on Splunk Cloud Platform.
Does Splunk charge for overages?
Splunk says it charges for overages only when you consistently exceed purchased ingestion or storage capacity. For Observability Cloud host plans, its docs say overage fees can reach 150% of the monthly list price per element.
Does Splunk limit the number of users?
Splunk says there are no explicit limits on users or usage at one organization. Licensing is governed by capacity such as ingest volume or seats, depending on product and deployment.
Can I compare Splunk Cloud log pricing to Sazabi per GB?
Not from public data. Splunk does not publish a per-GB price for Splunk Cloud Platform, so a fair comparison needs your quote.
Sources
- Starting prices for Observability Cloud, AppDynamics, On-Call and Agent Observability; contact-sales model for Cloud Platform and Enterprise; overage and Cloud Flex statements; Cisco telemetry weighted ingest rate (accessed Nov 8, 2026)
- Definitions of workload, ingest, activity-based and entity pricing and which products use each (accessed Nov 8, 2026)
- How host and container usage is averaged hourly, overage fees up to 150% of monthly list price, how to avoid overages (accessed Nov 8, 2026)
- Custom metric entitlements per host (100 Standard, 200 Enterprise), what host-based plans cover, archived and histogram metric counting (accessed Nov 8, 2026)
- Workload pricing for Splunk Cloud Platform, Splunk Virtual Compute units, fixed capacity purchased for peak demand (accessed Nov 8, 2026)
- Sazabi plans, included allowances, per-unit rates, retention (accessed Nov 8, 2026)
- Forwarding logs from an OpenTelemetry Collector to Sazabi with an otlphttp exporter (accessed Nov 8, 2026)