CrowdStrike Falcon LogScale (Humio) pricing in 2026: indexing-free per-GB

CrowdStrike Falcon LogScale (formerly Humio, acquired March 2021) prices on a per-GB ingested meter without the indexing surcharges that define Splunk Enterprise pricing. The architectural decision that produces this pricing model is the indexing-free design: LogScale's data plane uses an inverted-index-free schema-on-read approach that eliminates the index-build cost that Splunk amortises into its per-GB rate. The verified public anchor is the AWS Marketplace pay-as-you-go listing for Falcon Next-Gen SIEM at $0.00595 per MB, which is $5.95 per GB of third-party data. That single rate covers ingest, storage, and query with 13-month retention included, and Falcon-native telemetry is ingested at no additional charge. The indexing-free architecture means there is no separate indexing tier on top, but the per-GB rate itself is not cheap: at $5.95 per GB, log economics are driven almost entirely by how much third-party data you route in.

Retention default depends on the SKU. The 10 GB/day free third-party ingest tier for Falcon Insight XDR customers defaults to 7-day retention; the AWS Marketplace PAYG listing bundles 13-month retention; and retention is extendable to 36 months on committed contracts. Because retention is bundled into the ingest rate rather than billed as a separate per-GB-per-month archive tier, budget forecasting is simpler than the hot-warm-cold tiering that complicates Splunk Cloud, Datadog, and Sumo Logic comparisons. For compliance-driven customers, retention should be negotiated as part of the initial commit rather than added later: mid-term retention extensions land at list pricing.

The bundling with the broader Falcon platform is the second structural pricing dynamic. Falcon Next-Gen SIEM combines LogScale (data plane) with the existing Falcon Insight XDR (detection, response, investigation) and the Falcon agent (already deployed in any Falcon EDR customer environment). For existing Falcon EDR/XDR customers, the marginal cost of adding LogScale via Next-Gen SIEM is typically 20-30 percent below standalone LogScale plus standalone Falcon Insight, and the operational simplification (single agent, single console, single threat intelligence pipeline) is genuine.

The largest cost-discipline lever remains source-side filtering. LogScale's parser framework supports drop rules that prevent low-value events from counting against the per-GB meter at all. Aggressive use of drop rules on debug logs, routine NetFlow, verbose Windows event spam (Service Control Manager noise, routine logon successes), and similar low-fidelity sources typically removes 20-30 percent of metered ingest without affecting detection coverage. Customers who do not invest in source-side filtering pay for log volume that yields no security signal.

EA discounting at multi-year commits above $250K committed annual spend produces 25-30 percent off list as a routine outcome. Quarter-end pressure (particularly Q4 and end of CrowdStrike's fiscal year) carries the deepest discount band. Single-year transactional commits at scale leave value on the table; the discount math materially favours multi-year buyers.

The 2026 competitive position for LogScale is unusually strong. CrowdStrike's broader Falcon platform momentum is producing favourable bundling math against Splunk-plus-Microsoft-Defender or Sentinel-plus-Defender consolidation pitches, and the indexing-free per-GB rate is genuinely structural rather than promotional. For organisations evaluating Splunk consolidation in 2026, LogScale plus Falcon Next-Gen SIEM is the realistic alternative shortlist with Sentinel and Sumo Logic.

LogScale wins for existing CrowdStrike Falcon EDR/XDR customers who are evaluating SIEM consolidation. The consolidation math is the real argument: single agent, single console, single threat-intelligence pipeline, and Falcon-native telemetry ingested at no ingest charge. The 10 GB/day free third-party tier lets a Falcon customer stand up a working SIEM at zero ingest cost for a signal-focused source mix. The indexing-free architecture also avoids the index-build cost embedded in Splunk's per-GB rate. What it does not do is undercut Splunk on the headline per-GB rate: at $5.95 per GB PAYG, high-volume third-party ingest is expensive. The case is consolidation and bundled 13-month retention, not a cheaper meter.

For high-volume log analytics, the honest framing is a trade rather than a straight saving. Organisations ingesting 500 GB-plus per day of third-party data pay well into seven figures at the PAYG rate, so the win is not automatic cost reduction; it is avoiding the index-build overhead embedded in Splunk's rate, folding in 13-month retention, and consolidating onto the Falcon agent already deployed. Committed multi-year contracts discount off PAYG, and aggressive source-side filtering matters more here than at any other volume band.

LogScale is the wrong pick for organisations whose detection content is built around Splunk Enterprise Security depth, where the content library and search performance are the binding constraints rather than raw log analytics cost. It is also wrong for Microsoft-heavy shops whose log mix is dominated by Microsoft 365 and Azure sources, where Sentinel's bundled Microsoft ingest is structurally cheaper. And it is wrong for organisations not on the Falcon platform whose marginal cost of evaluation includes the broader Falcon agent rollout, which is a meaningful operational lift even when the SIEM economics are favourable.