We may earn a commission if you buy through links on this page. It never changes a score or a ranking. How we make money
Splunk combines security and observability, but teams looking to replace it often cite cost at high log volumes and the work of tuning detections. For developers, the choice is whether to move logs, metrics, and incident workflows to one hosted platform or operate separate tools. The options below include self-hosted and open-source choices, plus hosted services with listed starting prices. Treat those prices as starting points, not a forecast for your ingest volume or retention needs.
01Why people leave Splunk
High log volumes can drive costs
In a Reddit thread about 4 TB of daily logs, a team cited cost and future scalability as reasons to seek an alternative.
Unstructured logs complicate searches
Developers on Reddit recommend structured records and log-volume reviews before changing platforms; noisy data can inflate indexing costs.
Migration shifts work to your team
Reddit users point to detection engineering, tuning, and standardizing log formats as ongoing work after choosing a lower-cost SIEM.
02The alternatives, ranked by fit
- Best open-source platform
GrafanaGrafanaGrafana is a fit if you want to consolidate telemetry around OpenTelemetry or Prometheus and avoid making one hosted vendor the center of the stack. It is listed as open source, has a free plan, and starts at $19. Compare the API and SDK support you need against your current integrations, and model costs against telemetry growth before moving dashboards and alert workflows.
Trade-off: Costs can grow with telemetry use; check plan limits and integration coverage.
7.6/10from
$19/mofree plan - Best for self-hosted metrics
PrometheusPrometheusPrometheus is the clearest choice here for teams replacing Splunk's metrics role with an open-source, self-hosted system. It is listed at $0, and uses PromQL. You avoid usage fees for the tool, but your team runs the servers. Treat it as a metrics replacement, not a drop-in SIEM or full log-search platform, and plan how alerts and dashboards will connect to the rest of your stack.
Trade-off: You operate the servers; it is focused on metrics, not SIEM.
7.8/10from
Freefree plan - Best hosted observability
New RelicNew RelicNew Relic suits teams that want hosted observability rather than running their own monitoring servers. It has a free plan and starts at $10, with a free ingest allowance to assess before rollout. The platform covers observability and incident response across application and infrastructure; check ingest and user costs at your expected scale, and verify API and SDK coverage for your existing services.
Trade-off: Ingest and user costs can rise as usage scales.
7.2/10from
$10/mofree plan - Best for security and observability
DatadogDatadogDatadog is the closest fit for teams seeking a hosted platform across observability and security, especially in Kubernetes and cloud infrastructure environments. The listed starting price is $500. Model costs against telemetry volume and keep data collection deliberate; Reddit commenters discussing Splunk costs also recommend curating logs. Verify the required API and SDK integrations and the pricing basis before migrating production alerts.
Trade-off: Usage costs and telemetry volume need close management.
6.2/10from
$500/mo - Best self-hosted monitoring
ZabbixZabbixZabbix is worth considering if avoiding per-device license fees and self-hosting matter more than a managed service. It is open source, self-hostable, and has a free plan; no starting price is listed. Its focus is infrastructure monitoring, so scope it as a replacement for that part of Splunk rather than assuming it covers SIEM and log analytics. Budget for setup and tuning.
Trade-off: Setup and tuning are yours; it is infrastructure monitoring.
7.8/10from
Freefree plan - Best for cloud-native teams
DynatraceDynatraceDynatrace is a hosted option for teams consolidating observability, particularly those operating Kubernetes and cloud-native systems or using tracing and user monitoring. It starts at $7. That starting price is not a total-cost estimate: check the pricing model against your telemetry, retention, and users. Before replacing Splunk, confirm the API and integration coverage needed to move instrumentation, dashboards, and alert workflows.
Trade-off: Verify costs and integration details before production rollout.
7.1/10from
$7/mo
03Side by side
| Tool | Score | From | Free plan | Best for |
|---|---|---|---|---|
 Splunk Splunk (current) | 6.5 | $6/mo | Yes | Teams consolidating security and observability |
| Grafana Grafana | 7.6 | $19/mo | Yes | Teams consolidating telemetry signals |
| Prometheus Prometheus | 7.8 | Free | Yes | Teams monitoring systems and services |
| New Relic New Relic | 7.2 | $10/mo | Yes | Teams consolidating observability tools |
| Datadog Datadog | 6.2 | $500/mo | No | Teams consolidating observability and security |
| Zabbix Zabbix | 7.8 | Free | Yes | Teams with self-hosting capacity |
| Dynatrace Dynatrace | 7.1 | $7/mo | No | Teams consolidating observability tools |
Questions people ask
Is Splunk a type of SIEM?
Splunk includes security capabilities and is used for SIEM workflows, but it is broader than a SIEM: it also covers observability. Teams replacing it should map security detections, log search, and observability separately, then check which alternative covers each requirement.
Is Splunk a free tool?
Splunk is listed with a free plan and a starting price of $6. A free plan does not establish that a particular ingest volume, retention period, or security workload will fit without cost. Check the plan terms against your expected data and usage.
What companies use Splunk?
Splunk is suited to organizations combining security and observability, including teams with private-cloud requirements and security teams needing SIEM and SOAR. For a specific company or customer reference, check Splunk's published customer materials rather than assuming a named organization uses it.