Splunk is hired to collect logs, let people search them, and alert when something looks wrong. Costs usually follow data volume, and the work of leaving is rebuilding searches and alerts, not moving a file. Below: what to settle on retention, the open-source option, and a plan that runs both until the alerts are proven.
Logging is installed to answer a question during an incident and never removed. Over the years the saved searches pile up, a security or compliance alert gets attached, and the tool becomes part of how the company shows an auditor that it watches its systems.
Because the licenses are negotiated and billed once a year, the cost is reviewed rarely, and by then the contract is the reason people feel stuck.
A replacement is possible, but the work is in the retention rules and the alerts that cannot be allowed to go quiet.
Only alternatives we have checked. An open-source project is listed with the license its repository reports, on the date shown; one whose license could not be read as a single standard id is not offered as open source. Read the license guide before running any of them.
| Alternative | Kind | License | Read from |
|---|---|---|---|
| Grafana Loki | Open source | AGPL-3.0 | Grafana Loki repositoryChecked Oct 25, 2026 |
Each feature below is what the product's own page or README says, linked to where we read it on the date shown. Pros and cons are limited to what those pages state and to what the path itself changes. We do not rank products on quality.
| Plan | Price as published | Includes | Read from |
|---|---|---|---|
| Splunk Observability Cloud: Infrastructure | Starting at $15 per host per month, billed annually | Observability Cloud, infrastructure monitoring; starting price | Splunk pricingChecked Oct 25, 2026 |
| Splunk Observability Cloud: App & Infra | Starting at $60 per host per month, billed annually | Observability Cloud, application and infrastructure; starting price | Splunk pricingChecked Oct 25, 2026 |
| Splunk Observability Cloud: End-to-End | Starting at $75 per host per month, billed annually | Observability Cloud, end to end; starting price | Splunk pricingChecked Oct 25, 2026 |
List prices as printed on Splunk's pricing page on the checked date, in US dollars and excluding tax, and billed annually. Prices may differ at checkout. The page prints no price for Splunk Cloud Platform or Splunk Enterprise, only their pricing models, so none is shown for them.
Log tools bill by data volume or activity, so the cheapest change is often to stop sending logs nobody reads. The next question is how long logs must be kept, because retention can be a compliance obligation and not a preference.
Grafana Loki, the open-source option here, is published under the AGPL-3.0 license according to its repository on the checked date. It is software you run, so you provide storage, upgrades and backups. AGPL network-use obligations apply to modified versions, so read the license. We rate this hard because the migration is rebuilding searches and alerts, not copying a file.
Samples are made up and are not Splunk's prices. Type in the figures from your own invoice or order form.
The honest yearly cost of running open-source software yourself, set against the bill it replaces, with the seat count where it stops paying.
Paid seats against seats in use: what the idle ones cost a year, and what you save by right-sizing at renewal.
Arithmetic only, not tax, accounting or legal advice. Check the figures against your own order form.
Do not end the old contract until the alerts have fired from the new system. In outline:
List every source sending logs, the volume of each, and whether anyone has searched it in the last quarter. Stop sending the ones nobody reads.
Write down how long each type of log must be kept and why: contract, audit, regulation or habit. This sets what the new system, or an archive, has to hold.
List every saved search, report and alert, who relies on it, and where the notification goes. Mark the security and compliance ones.
Stand up the new system for one source and recreate its searches and alerts. Compare results for the same time window against the old system.
Trigger each critical alert on purpose and confirm the right person is notified through the right channel.
Send logs to both systems for at least a full month, including a deploy and a busy period, and compare what each caught.
Move the remaining sources in small groups and update the on-call runbook as each one moves.
Export what retention requires, confirm the archive can be read, then end the contract inside its notice window.
Run the vendor report for QuickBooks Online or Xero, then open the free audit.
General information, not legal advice. See cancelling without penalties. Last reviewed Oct 25, 2026. Product names belong to their owners and are used only to identify them.
Send us the export and see which lines are worth a second look. A connected version is planned. Splunk is one of the lines worth a look.
Worked example. Type over it.
Result
| Self-hosting, per year | Amount |
|---|---|
| Hosting, backups, tooling | 720.00 |
| Admin and restore-test time | 2,640.00 |
| Total | 3,360.00 |
| One-off set-up (not in the yearly total) | 1,200.00 |
The saving holds only if the time is real. Price the admin hours at what that person's time costs the company, not at zero.
Worked example. Type over it.
Result
“In use” is your call: last sign-in in the past 30 or 90 days from the vendor's admin report. A seat for someone on leave is not idle.