Splunk Alternatives: Why Security Teams Move Logs to a Lakehouse

At a Glance

The strongest Splunk alternative for most mid-market and enterprise teams is not a single tool but a split: keep a SIEM for real-time alerting, and move bulk log storage and hunting to a lakehouse or security data lake normalised to OCSF. Microsoft Sentinel, Google Security Operations, Elastic Security and Databricks Lakewatch are the main destinations to evaluate.

• Cost: the saving comes from sending fewer gigabytes to an ingest-priced tool, not from a cheaper licence alone.
• Effort: detection rules and dashboards must be rewritten for any new query language. Inventory them before you sign.
• Risk: a staged move, where the old SIEM keeps running while the lake fills, protects the SOC from a blind spot.
• Fit: teams already running Databricks or a hyperscaler security lake have the shortest path.

Splunk pricing is the reason this search exists. Splunk does not publish a simple list price, but a third-party estimate from Expanso’s Splunk pricing guide puts ingest-based Splunk Cloud in the low hundreds of dollars per GB of daily ingest on an annual commitment, before the Enterprise Security add-on. Treat that as an outside estimate, not Splunk’s own figure, and check it against your contract.

The data side has moved at the same time. The Open Cybersecurity Schema Framework, which Splunk helped found, now has more than 900 contributors according to Databahn’s OCSF overview. A shared schema means your logs no longer have to live inside the tool that searches them.

So the real problem is rarely “Splunk is expensive.” It is that one ingest-priced system holds every log for every purpose: alerting, hunting, compliance retention and reporting. Each of those jobs has a cheaper home, and the alternatives below differ mainly in which jobs they take over.

Quick Comparison of Splunk Alternatives

What Makes Leaving Splunk Hard

• SPL is everywhere. Detections, saved searches and dashboards are written in Splunk’s Search Processing Language. Every one of them has to be translated, tested and re-tuned for false positives.
• Nobody owns the full source list. Forwarders were added over years by different teams. Without an inventory of sources, volumes and dependent detections, you cannot size the move or know what breaks.
• Contract timing drives the project. Renewal dates force rushed decisions. A migration planned backwards from a renewal usually cuts the testing phase first.
• Retention rules are buried in policy. Compliance teams often require a year or more of certain logs. If the new home cannot prove retention and access controls, the audit finding lands on security.
• Analyst habits are real. A SOC that knows one console will resist a second one. Plan training and parallel running, not a hard cutover.

1. Databricks Lakewatch

Databricks Lakewatch was announced on 24 March 2026 as an agentic SIEM built on the lakehouse. It launched in Private Preview with customers including Adobe and Dropbox, stores data in Delta Lake or Apache Iceberg in your own cloud storage, and is built on OCSF. Detections are defined in YAML with SQL or Python, backtested against history and deployed through CI/CD. Databricks says Anthropic’s Claude models help power its signal correlation.

Strengths:

• Security data sits next to HR, asset and finance data in one governed catalog.
• Open storage formats, so the data outlives any one tool.
• Detection-as-code with backtesting built into the workflow.

Limitations:

• Private Preview only, with no published pricing or general availability date.
• Best value assumes you already run Databricks and have data engineering skills.

2. Microsoft Sentinel

Microsoft Sentinel is Microsoft’s cloud SIEM, and its data lake tier keeps a single copy of security data in open Parquet files for up to 12 years. Analysts query with KQL or Jupyter notebooks and promote data from the lake tier to the analytics tier when they need alerting on it.

Strengths:

• Native connectors for Microsoft Defender, Entra ID and Microsoft 365.
• Two storage tiers split alerting cost from retention cost.

Limitations:

• KQL is another language to retrain on after SPL.
• Economics are strongest for estates that are mostly Microsoft.

3. Google Security Operations

Google Security Operations, formerly Chronicle, is Google Cloud’s SIEM and SOAR platform. It normalises incoming logs to its Unified Data Model, and detection rules are written in YARA-L.

Strengths:

• Built for very large log volumes and fast search across them.
• SIEM and response automation in one product.

Limitations:

• YARA-L and UDM are Google-specific, so rules do not travel easily.
• No public list price to compare against a Splunk renewal.

4. Elastic Security

Elastic Security runs SIEM and endpoint protection on Elasticsearch, available self-managed or as a cloud service. Its detection rules are developed in the open, which makes them a useful reference even for teams that do not adopt the product.

Strengths:

• Choice of self-managed or hosted deployment.
• Open detection rule repository and a documented common schema.

Limitations:

• Self-managed clusters need real operations effort at scale.
• Long retention still costs cluster storage unless you tier it carefully.

5. Amazon Security Lake

Amazon Security Lake is not a SIEM. It centralises security data from AWS and third-party sources into a data lake in your own account and normalises it to OCSF, so any SIEM or analytics tool can subscribe to it.

Strengths:

• OCSF normalisation handled by the service.
• Data stays in your AWS account and storage.

Limitations:

• You still need a SIEM or analytics layer on top for detection.
• Strongest when most sources already live on AWS.

6. Cribl Stream

Cribl Stream is a telemetry pipeline that collects, reduces, enriches and routes data before it reaches a destination. It can strip unneeded fields and send full-fidelity copies to cheaper storage while the SIEM receives only what it alerts on.

Strengths:

• Cuts SIEM ingest volume without replacing the SIEM.
• Routes the same event to several destinations at once.

Limitations:

• Adds a layer to operate and license rather than removing one.
• Does not detect anything on its own.

7. Wazuh

Wazuh is a free, open-source platform that combines SIEM and XDR capabilities, with a paid managed option called Wazuh Cloud. It is the usual answer when a smaller team asks for a Splunk alternative with no licence cost.

Strengths:

• No licence fee for the open-source edition.
• Endpoint agent and SIEM functions in one project.

Limitations:

• You own the infrastructure, scaling and upgrades.
• Large, mixed-format log estates need significant tuning.

Why the Lakehouse Keeps Coming Up

Look at the list again and a pattern appears. Sentinel added a lake tier, AWS built a security lake, Cribl routes data to cheap storage, and Databricks built a SIEM directly on the lakehouse. Every serious alternative separates storing logs from alerting on them.

That separation is a data engineering decision, which is why we say cybersecurity is a data engineering problem. Normalise logs once to OCSF in a silver layer, keep them in open tables, and the choice of alerting tool becomes reversible. Our guides to OCSF normalisation and data security posture management cover the governance side of that design, and Databricks cost optimization covers keeping query compute in check once the volume moves.

Questions to Ask Before You Sign or Build

• How many GB per day do we ingest, by source, and which sources feed an active detection? Sources with no detection are the first candidates to leave the ingest-priced tier.
• How many SPL searches and detections are in use, and who owns each? This number sets the migration effort more than any licence price.
• Where will logs live in three years, and in what format? Open tables in your own storage keep the next migration cheap.
• Does the option support OCSF natively, or will we maintain a translation layer?
• Can security data join our business data under one set of access controls? If yes, a lakehouse design pays twice.
• Is the product generally available, and is the price published? Preview products are worth piloting, not betting a renewal on.

If you want an independent read on your source inventory and a staged plan for moving bulk logs to the lakehouse, talk to our Databricks consulting team.

Frequently Asked Questions (FAQs)

What is the best Splunk alternative?

There is no single best option. Microsoft-centred teams usually shortlist Sentinel, Google Cloud teams look at Google Security Operations, and teams already on Databricks should evaluate a lakehouse design and Lakewatch. The right answer follows where your data and skills already are.

Is there a free alternative to Splunk?

Wazuh is free and open source, and Elastic offers self-managed options. Free licences still carry infrastructure and staff costs, so compare total running cost, not just the licence line.

Can we keep Splunk and still cut costs?

Yes. Many teams keep Splunk for alerting and send bulk, low-alert sources such as DNS, flow and proxy logs to a data lake. A pipeline tool such as Cribl Stream or a lakehouse ingestion layer handles the routing.

How much does Splunk cost?

Splunk does not publish a simple list price. Third-party estimates, such as Expanso’s, place ingest-based Splunk Cloud in the low hundreds of dollars per GB of daily ingest per year, with Enterprise Security extra. Use your own contract as the real baseline.

Is Databricks Lakewatch generally available?

No. Databricks announced Lakewatch on 24 March 2026 in Private Preview, and no general availability date or pricing has been published. You can build a security data lake on Databricks today without it.

How long does a move off Splunk take?

It depends on detection count far more than data volume. A staged plan that moves bulk sources first and detections second lets the SOC keep working throughout, and avoids tying the whole project to one renewal date.