What This Comes Down To
Splunk does not publish its security pricing. Most contracts are still sized by gigabytes ingested per day, with Enterprise Security on top, and benchmark sites report that $2M a year buys roughly 500 to 1,000 GB a day. The budget lever is splitting data into two tiers: cheap storage for history, expensive indexing only for what detections actually query.
- Cost: reported list rates run about $1,800 to $2,500 per GB/day per year before discounts, plus an Enterprise Security premium.
- Effort: moving bulk telemetry to a lakehouse is a data engineering project measured in quarters, not a weekend migration.
- Risk: detection content, not storage, is what breaks when you move logs carelessly.
- Tiering: Splunk itself now sells a separate, cheaper path for searching data left in Amazon S3, so the two-tier model is not only a lakehouse argument.
- When it fits: renewal is 6 to 12 months out and more than half your ingest is low-value telemetry nobody searches.
Splunk, now part of Cisco, lists four ways to buy on its pricing page: activity-based, ingest, workload and entity pricing. It publishes dollar figures for observability products, such as infrastructure monitoring from $15 per host per month, but not for the security platform most SIEM budgets are spent on. Those numbers come from quotes, and from the benchmark sites that collect them.
The most detailed public benchmark we have found, VendorBenchmark, reports list pricing of $1,800 to $2,500 per GB/day for a one-year term on the core platform, with Enterprise Security adding a further $400 to $600 per GB/day. It reports enterprise discounts of 25 to 55 percent off list. None of that is Splunk’s own published price, and you should treat every figure in this article the same way: reported, useful for sizing, and replaced by your own quote the moment you have one.
The budget holder’s problem is rarely the rate. It is that nobody can say which of the gigabytes being paid for are actually used for detection, and which are firewall, DNS and flow logs kept just in case an auditor or an investigator asks.
How Is Splunk Pricing Calculated?
Three meters matter for a security buyer. Read your order form to find out which one you are on, because the negotiation is different for each.
| Model | What you pay for | What drives the bill up | Where the budget holder can push |
|---|---|---|---|
| Ingest pricing | Gigabytes indexed per day, annualized into a term license | New log sources, verbose logging levels, duplicate forwarding | Filter and route before data reaches the indexer |
| Workload pricing | Compute capacity for search and analytics, reportedly sold in capacity packs | Heavy scheduled searches, dashboards nobody opens, inefficient correlation rules | Search hygiene and retiring unused content |
| Entity pricing | Hosts or entities monitored | Growth in endpoints, servers and cloud instances | Scope which entities need full SIEM coverage |
| Enterprise Security add-on | The SIEM application on top of the platform | Priced against the same volume or capacity metric | Separate the security-relevant volume from the operational volume |
One trap in reading benchmark sites: units. MonitoringCost reports a legacy rate card of $150 to $200 “per GB per day”, which looks an order of magnitude cheaper than VendorBenchmark. It appears to be a monthly figure. Multiply by twelve and it lands at $1,800 to $2,400, inside the annual band above. Before you compare any two numbers, confirm whether each is monthly or annual, list or negotiated, platform only or including Enterprise Security.
What Does $2M a Year Actually Cover?
VendorBenchmark publishes a tier table that answers this directly. It reports negotiated annual totals of $1M to $3M at 500 to 1,000 GB/day, $400K to $1.5M at 200 to 500 GB/day, and $3M to $10M or more above 1,000 GB/day. A $2M contract, on those reported figures, buys somewhere in the 500 to 1,000 GB/day band at an achievable rate of roughly $400 to $750 per GB/day.
What that money buys is indexed, searchable data inside a retention window, the Enterprise Security correlation engine if you licensed it, and the detection content your team has built over years. That last item is the asset. Storage is a commodity; five years of tuned correlation searches are not.
What it does not buy is cheap history. Every additional day of retention in hot, searchable storage carries the same volume economics. That is why many teams quietly cap retention, push older data to frozen storage, and then cannot answer an investigator who asks what a service account did nine months ago.
Why Is SIEM Spend Splitting Into Two Tiers?
Because the expensive part of a SIEM is the analytics tier, not the bytes on disk, and vendors have started pricing them apart. Splunk’s own documentation describes Federated Search for Amazon S3 as a way to search S3 data “without the need to ingest or index it first,” aimed at historical security investigations and infrequently accessed compliance data. It is licensed separately, in Data Scan Units of 10 TB of scanning capacity each.
That is a two-tier structure: pay the indexing rate for what detections query every few minutes, pay storage plus a scan fee for what investigators query a few times a year. Here is what it does to the bill, using VendorBenchmark’s reported bands and two stated assumptions.
| Scenario (assumptions in brackets) | Indexed tier | Storage tier | Reported indexed-tier band |
|---|---|---|---|
| Everything indexed [750 GB/day] | 750 GB/day | None | $1M to $3M a year |
| Bulk telemetry tiered out [60 percent of volume is low-value] | 300 GB/day | 450 GB/day, about 20 TB a year after compression [8:1] | $400K to $1.5M a year, plus storage and scan or query costs |
The 60 percent figure is an assumption to replace with your own source inventory, not a benchmark. The point for a budget holder is the shape: the cost line that moves is the indexed tier, and the storage tier is cheap enough that retention stops being the thing you cut to hit a number. Whether the second tier lives in Splunk’s S3 options or in a lakehouse you own is a separate decision, covered below.
Where Does the Money Leak?
Telemetry nobody searches
Firewall accepts, DNS queries, VPC flow logs and verbose endpoint events make up a large share of daily volume in most estates we assess. They matter for investigations and threat hunting, but few correlation rules read them. Paying an indexing rate for data that is searched a few times a year is the single biggest leak in a volume-priced contract.
Duplicate and unfiltered forwarding
The same events often arrive twice: once from a cloud provider’s native export and once from an agent on the host. Debug-level logging left on after an incident adds more. Nobody owns the forwarding configuration, so nobody notices until renewal. This is a process defect, and as a Lean Six Sigma Master Black Belt I treat it the way I would treat rework on a production line: measure it by source, then remove it at the source.
Retention set by budget, not by requirement
When retention is a cost line, it gets cut to fit the budget. The result is a retention policy that satisfies nobody: too expensive to extend and too short for investigations or audit. Our security data lake guide walks through separating hot detection storage from cheaper long-term history.
Search compute spent on dead content
On workload pricing, scheduled searches and dashboards consume capacity whether or not anyone reads the output. An inventory of saved searches by last-viewed date usually finds a long tail of content that can be retired before you buy more capacity.
What Does the Same Log Volume Cost on a Lakehouse?
A security lakehouse stores logs as open-format Delta tables in your own cloud object storage, normalizes them to a common schema such as OCSF in the silver layer, and runs detections and investigations as queries. Storage and compute are billed separately, so history gets cheap and the cost moves to whatever compute you actually run.
Here is the arithmetic with every assumption labelled. Replace each one with your own numbers; the structure is what matters.
| Line item | Assumption | Result |
|---|---|---|
| Daily volume | 750 GB/day, the middle of the band a $2M contract reportedly buys | About 274 TB of raw logs per year |
| Compression | Assume 8:1 for log text stored as Delta (columnar Parquet). Measure your own sources; ratios vary widely | About 34 TB stored per year of history |
| Object storage | Assume $23 per TB per month. Check your cloud provider’s current rate card and region | About $9,400 a year to keep one full year of history |
| Ingestion and normalization compute | Unknown until measured. Depends on parsing complexity and streaming versus batch | Measure in a 30-day pilot on two or three sources |
| Detection and investigation compute | Unknown until measured. Depends on rule count, schedule and analyst query habits | Measure in the same pilot |
| Engineering and content migration | People time to rebuild parsers and port detections | Usually the largest one-time cost |
Two things fall out of that table. Storage for a year of history is a rounding error next to a seven-figure license, which is why the lakehouse argument starts with retention. And the honest comparison is not storage against license; it is license against compute plus people, which you can only know by measuring. Anyone who quotes you a savings percentage before a pilot is selling.
The common mid-market pattern is not rip and replace. It is the two-tier split from earlier, with the lakehouse as the storage and investigation tier: keep high-fidelity, detection-critical sources in Splunk, send bulk telemetry to Delta tables you own, and query across both. The difference from a vendor archive is that the lakehouse tier is also your governed data platform, so the same normalized security data can feed detections, audits and AI work without a second copy. Our Splunk alternative comparison covers the options for that second destination.
The vendor side is moving too. Databricks announced Lakewatch, an agentic SIEM built on the lakehouse, in March 2026 in Private Preview, and in June 2026 agreed to acquire Panther, an AI SOC platform. Neither changes the arithmetic above. Both mean the normalized security data you build now has more than one place to go later.
Are You Ready to Renegotiate, or Not Yet?
You are ready when these signals are true:
- You can list your top 20 log sources by daily volume, and name which correlation rules read each one.
- Renewal is at least six months away, so a pilot can finish before you sign.
- Your cloud data platform already runs governed pipelines, so security data lands somewhere with access control and lineage from day one.
- Someone owns detection content and can say which rules must move first and how to test them.
You are not ready when these are true:
- Nobody can say which sources the SOC actually searches; fix the inventory first or you will route away data you need.
- Renewal is under 90 days out; negotiate a one-year term and use it to measure.
- The plan depends on a savings figure from a vendor deck rather than a pilot on your own sources.
If the first list describes you, our lakehouse security engineering work starts with exactly that inventory: volume by source, consumers by rule, and a routing plan you can take into the renewal.
Frequently Asked Questions (FAQs)
How much does Splunk cost per GB?
Splunk does not publish security pricing. VendorBenchmark reports list rates of about $1,800 to $2,500 per GB/day per year for the core platform, with negotiated rates far lower at volume. Your own quote replaces any benchmark.
Is Splunk Enterprise Security included in the platform price?
No. Enterprise Security is licensed on top of the platform. VendorBenchmark reports it adding roughly $400 to $600 per GB/day at list, priced against the same volume or capacity metric.
Does Splunk still charge by ingest volume?
Ingest is one of four models Splunk lists, alongside workload, entity and activity-based pricing. Many security contracts are still volume based, so check your order form to see which meter applies to you.
Can a lakehouse replace Splunk completely?
Sometimes, but most mid-market teams start by routing bulk telemetry to the lakehouse and keeping detection-critical sources in Splunk. A pilot on your own sources tells you whether full replacement makes sense.