Splunk pricing in 2026: per-GB costs, Cloud vs Enterprise, and real spend
The independent Splunk pricing reference. Per-GB list rates from published reseller rate cards, workload SVC tiers, Cloud vs Enterprise trade-offs, and five real cost scenarios from startup to MSSP. Updated July 2026.
Splunk pricing calculator
Splunk Cloud bills per GB ingested per day on a rate that tapers with commit volume: roughly $1,000 per GB/day/yr at a typical 50 GB/day deployment, rising toward $1,620 at single-digit volumes and falling below $750 at very high volume. Enterprise Security roughly doubles the base ingest licence, and multi-year Enterprise Agreements above $500K list see 25 to 40 percent off. Set your daily volume and the ES add-on below for a live annual estimate. Splunk publishes no public per-GB list, so treat the output as a planning band, not a quote.
Without ES or equivalent custom content you have log analytics, not a SIEM. Most genuine SOC deployments require it.
Splunk Cloud base licence at roughly $900-$1,100 per GB/day per year; headline includes ES at roughly 2x base. Add storage, deployment services, and analyst staffing for full TCO (typically 2x-3x licence).
How Splunk pricing actually works
Splunk has been a Cisco company since Cisco closed its $28 billion acquisition in March 2024. Pricing mechanics below are unchanged so far, but expect Splunk to surface in Cisco enterprise agreements and bundle negotiations over time, which can change the leverage available at renewal.
Splunk's headline model is per-GB ingested per day, billed monthly or annually depending on contract. The meter starts the moment a log line crosses the forwarder. Compression in storage does not reduce the bill: 1 GB ingested is 1 GB billed regardless of how it sits at rest. That single rule is the single biggest reason Splunk bills run away from forecast.
Workload-based pricing was opened to all Splunk Cloud customers at .conf21 in 2021 and has since become the default-recommended model on new Cloud agreements. It swaps pure ingest for a Splunk Virtual Compute (SVC) unit. SVCs measure search compute, not raw ingest. For predictable, search-heavy workloads this saves 15-25 percent. For ingest-heavy compliance use cases it can run slightly higher than the legacy per-GB model. Read your contract carefully.
On top of base ingest, Splunk sells premium apps that most genuine SIEM deployments require. Enterprise Security (ES) roughly doubles the base ingest licence: on published rate cards the ES per-GB rate is close to the base ingest rate itself. IT Service Intelligence (ITSI) is a separate line. Splunk SOAR is sold separately again. Stack the add-ons and the true Splunk SIEM bill runs roughly 2 to 3 times the base ingest list price.
Splunk Virtual Compute (SVC): the numbers Splunk does not publish
Splunk does not publish SVC list prices anywhere on splunk.com. The calculator at splunk.com/en_us/products/pricing/pricing-calculator.html sizes SVCs from your inputs and routes to sales. Customer-reported ranges are the only public triangulation available, and the spread is wide.
Splunk publishes no SVC list price. This is implied from the GB-equivalent (a 100 GB/day balanced deployment maps to roughly 20-34 SVCs against a ~$80K-$160K licence), not a Splunk-quoted rate. Treat as a rough estimate only.
Rough practical entry point for workload-pricing customers (about a 50 GB/day balanced workload). Below this, ingest-based licensing is usually the simpler model.
SVC-to-GB conversion (rule of thumb)
| Workload profile | SVCs per GB/day ingest | Implied at 100 GB/day |
|---|---|---|
| Ingest-heavy, light search | 1 SVC per 5-7 GB/day | 14-20 SVCs |
| Balanced workload | 1 SVC per 3-5 GB/day | 20-34 SVCs |
| Search-heavy, ES + ITSI | 1 SVC per 1.5-3 GB/day | 34-67 SVCs |
Conversion factors triangulated from partner enablement decks and customer-posted breakdowns over 2023-2025. Splunk's own calculator is authoritative for your specific workload but requires sales engagement.
When workload pricing beats ingest pricing
- + Predictable search load against a stable corpus
- + Heavy use of accelerated data models (Enterprise Security)
- + Long-retention searches that re-scan archived data
- - Spiky or unpredictable ingest patterns
- - Compliance-only logging with minimal search activity
- - Small deployments below the ~20 SVC entry point
Splunk Cloud vs Splunk Enterprise: cost comparison
- + Pure OpEx, no hardware
- + Splunk operates the indexer cluster
- + Faster onboarding, 2-4 weeks typical
- - ~10-25% licence premium per GB vs Enterprise
- - Data residency limited to Splunk regions
- - Customisation more constrained
- + Lower per-GB licence cost
- + Full control over indexer cluster
- + Wins on unit cost above ~750 GB/day
- - Hardware: $200K-$500K capex per refresh
- - Splunk admin engineer required (~$160K/yr)
- - 3-6 month deployment timeline
Splunk Enterprise: vCPU and reference hardware sizing
Self-managed Splunk Enterprise uses Splunk-published reference hardware specs from help.splunk.com. Sizing drives infrastructure cost and is the single biggest variable behind self-managed TCO.
| Role / tier | vCPU | RAM | GB/day per indexer |
|---|---|---|---|
| Indexer, minimum reference | 24 vCPU | 12 GB | Up to 300 GB/day max |
| Indexer, mid-range | 48 vCPU | 64 GB | 100 GB/day recommended |
| Indexer, high-performance | 96 vCPU | 128 GB | Higher with search headroom |
| Indexer with Enterprise Security | 48-96 vCPU | 64+ GB | 60 GB/day per indexer |
| Search head | 32 vCPU | 12 GB | Sized by concurrent users |
Source: Splunk Enterprise Deployment Capacity Manual, current documentation at help.splunk.com.
Sustained storage IOPS must meet or exceed 800 per Splunk's published requirement. Below that, search performance degrades under concurrent load and the indexer bottlenecks on disk rather than CPU.
Splunk compresses ingested data roughly 2-to-1 at rest. Plan storage for half the daily ingest volume, multiplied by retention days, with headroom for hot and warm bucket overlap.
Enterprise Security inflates indexer count significantly at the same ingest volume because of accelerated data model rebuilds. A 300 GB/day raw Splunk environment may run on 2-3 indexers; the same environment with ES typically needs 5 or more.
Real-world Splunk cost scenarios
| Scenario | Profile | Licence | Total TCO | Notes |
|---|---|---|---|---|
| Startup | 5 GB/day, Splunk Cloud, 90-day retention | $8K-$14K | $28K-$45K | Add-ons stay disabled at this scale |
| Mid-market | 50 GB/day, Splunk Cloud, 365-day retention | $50K-$65K | $210K-$290K | ES add-on (roughly doubles licence) typically required for SOC use |
| Enterprise | 200 GB/day, hybrid, 365-day retention | $150K-$200K | $650K-$950K | Per-GB rate falls with volume; ES and staffing dominate TCO |
| Large enterprise | 1 TB/day, on-prem, 24-month retention | $650K-$800K | $2.5M-$3.5M | Multi-year EA with 25-40% list discount typical |
| MSSP multi-tenant | 500 GB/day aggregate, Splunk Cloud | $365K-$450K | $1.4M-$2M | Per-tenant indexing complicates volume math |
TCO includes Splunk Cloud licensing or Enterprise licence plus infrastructure, ES add-on, professional services for initial deployment, and one analyst FTE per 50-75 GB per day. Discounts of 25-40 percent are routine on Enterprise Agreements.
Five proven Splunk cost optimisations
Filter at the edge
Save 30-50%Drop verbose Windows event noise, debug logs, and DNS chatter at the forwarder. Most environments cut 30 percent or more without losing detection coverage.
Summary indexing
Save 10-20%Roll up high-volume sources into summary indexes for long-term searches. Detail data lives in cold storage; queries hit the summary.
Workload pricing tiers
Save 15-25%Splunk's SVC-based workload pricing rewards predictable search loads over spiky ingest. Right-sizing SVCs after baseline data exists is essential.
Archive to cold tier
Save 60-80%S3 or Glacier archive replaces hot storage for retention beyond 90 days. The compliance clock keeps ticking; the indexing bill does not.
Multi-year EA negotiation
Save 25-40%Enterprise Agreements above $500K list see 25-40 percent off in routine negotiations. Splunk's quarter-end is the right pressure point.
Splunk vs Sentinel vs QRadar at 50 GB per day
Same environment, three vendors, twelve months. List prices before any negotiated discount.
On base ingest licence alone, Splunk is competitive at this volume. Its real premium appears once you add Enterprise Security, which roughly doubles the Splunk licence to around $100K, and at higher volumes where the per-GB rates diverge. Sentinel is close on a commitment tier; QRadar's per-EPS model has stronger appeal in regulated industries. Compare like for like: the Splunk figure here is base ingest only.