Splunk

What it is

Splunk is a commercial platform for ingesting, indexing, and searching machine-generated data — logs, metrics, and events — originally built for IT operations troubleshooting and now equally prominent as a SIEM (security information and event management) platform. Founded in 2003 and public for over a decade, Splunk was acquired by Cisco in March 2024 for roughly $28 billion; as of 2026 it operates as a wholly owned Cisco subsidiary that has retained its own brand and much of its product organization, while Cisco has folded its own observability efforts (including AppDynamics) into Splunk’s unit rather than replacing Splunk with them.

Splunk’s defining feature is its Search Processing Language (SPL), a pipe-based query language that predates most modern observability query languages and remains one of the most expressive tools in the space for ad hoc investigation across arbitrary unstructured or semi-structured data. Splunk indexes full event content (similar in spirit to Elasticsearch) and layers on dashboards, alerting, and — particularly on the security side — detection content, threat intelligence integrations, and SOAR-style response automation.

Why teams choose it

• SPL is genuinely powerful for ad hoc investigation. Security and ops teams doing deep forensic search over messy, varied data often find SPL faster to work with than SQL-like or PromQL-like alternatives, once the learning curve is climbed.
• Deep incumbency in enterprise security operations. Splunk’s SIEM content, integrations, and compliance tooling are mature and widely certified, which matters heavily for regulated industries already standardized on it.
• Cisco ownership brings integration potential but also uncertainty. Bundling with Cisco’s networking and security portfolio is a plus for existing Cisco shops, but the acquisition has also raised customer questions about long-term roadmap direction and pricing that are still settling out.
• Cost is the most common complaint. Splunk’s traditional per-GB-ingested pricing scales steeply with data volume, which has driven many teams to either aggressively filter what they send to Splunk or migrate high-volume, low-value logs elsewhere.

Pricing model

Splunk offers several pricing structures rather than one: legacy ingest-based pricing (cost scales with GB of data ingested per day), workload-based pricing on Splunk Cloud Platform (cost scales with compute consumed by searches and dashboards rather than raw volume), and entity-based pricing for certain security use cases. Workload pricing is now the more commonly adopted model for new Splunk Cloud customers because it decouples cost from ingest volume, but ingest-based pricing remains widely used, especially in on-premises Splunk Enterprise deployments. A limited free tier exists for small-scale or personal use.

Alternatives

Elasticsearch / the ELK stack is the most common open-source-rooted alternative for log search and SIEM-adjacent use cases, at typically lower cost but with more self-managed operational effort. Datadog offers a SaaS log management and security product with usage-based pricing that many teams evaluate as a lower-complexity alternative to Splunk for pure observability (non-SIEM) use cases. On pure cost-per-volume grounds, label-indexed systems like Grafana Loki are a common destination for high-volume, low-search-value logs that teams no longer want to pay Splunk ingest rates on.