Splunk Pricing 2026: Every Plan, Real Costs and Hidden Fees

Splunk Enterprise Security publishes no price in 2026, and a per-seat price is the wrong question. Essentials and Premier are quote-only, and that license adds no ingest on Splunk Cloud or Enterprise. The rates are Observability Cloud Infrastructure at $15 per host a month and On-Call at $5 per user a month, billed annually, with On-Call capped at 10 seats. Those figures were read on Splunk's pricing page on 17 October 2026.

Toolradar data: Splunk is the most compared security monitoring tool on Toolradar over the last 90 days, with 299 side-by-side comparisons, and it is listed as an alternative to 61 other tools. Toolradar, the software directory we run, tracks 26 security monitoring tools as of 17 October 2026. The category page is security monitoring, and the product profile is Splunk.

Those comparisons stay open because the SIEM has no sticker. Cloud Platform and Splunk Enterprise sell unlimited users, so analyst headcount never becomes the bill. Enterprise Security is the app on that platform license, metered in daily gigabytes, Splunk Virtual Compute units, or vCPUs, and you price that meter before asking sales for the app.

At a glance

What you are buying	Best for a security team	Price read 17 October 2026	What that price leaves out
Enterprise Security Essentials	Human-led detection on data the platform license already allows	Does not publish a price. The card says get a quote	SOAR, UEBA, and automated threat analysis
Enterprise Security Premier	SIEM plus SOAR, UEBA, and automated threat analysis in one app	Does not publish a price. The card says get a quote	Ingest or compute. Premier does not enlarge the platform license
Splunk Cloud Platform	Splunk-hosted search, on activity, workload, or ingest pricing	Does not publish a price	The Enterprise Security app
Splunk Enterprise	Private cloud, on-prem, or an air-gapped stack	Does not publish a price	The Enterprise Security app
Splunk Free	One standalone box, under 500 MB indexed a day, with no alerts	$0. The license does not expire	Logins, alerting, clustering, and distributed search
Observability Cloud Infrastructure	Host metrics, log connect, network explorer, and uptime checks	Starts at $15/host/mo, billed annually	APM, real user monitoring, and browser synthetics
Observability Cloud App & Infra	Infrastructure plus APM and synthetic API checks	Starts at $60/host/mo, billed annually	Real user monitoring and browser synthetics
Observability Cloud End-to-End	The full card, including real user monitoring	Starts at $75/host/mo, billed annually	Database monitoring and Secure Application, both unpriced
Agent Observability	Agent spans, with a Luna token allowance	Starts at $100/mo per 1.2 million spans a year, billed annually	Tokens and retention past the included allowance
AppDynamics Infrastructure	On-prem infrastructure, priced by processor	Starts at $6/vCPU/mo, billed annually	Application performance monitoring
AppDynamics Premium	APM, database monitoring, and logs, priced by host	Starts at $33/host/mo, billed annually	Transaction analytics
AppDynamics Enterprise	Premium plus transaction analytics	Starts at $50/host/mo, billed annually	Security, RUM, browser synthetics, and SAP, sold as add-ons
Splunk On-Call	A rotation of 10 people or fewer	Starts at $5/user/mo, billed annually	Seat 11. No rate is printed past 10 seats
Splunk SOAR, standalone	Light automation before a Premier order	Free for up to 100 actions a day. The paid product does not publish a price	SOAR inside Enterprise Security Premier
IT Service Intelligence	Service prediction on the same platform	Does not publish a price. Workload or ingest	A platform license underneath

A quote that only says "Splunk" is not a budget, because the edition, the meter, and the retention are the bill. The SIEM tools guide compares products, and this page is the invoice those cards refuse to print. For a platform that publishes an ingest rate, use the Splunk alternatives guide. Microsoft Sentinel is the usual Azure comparison there when the gap is a printed gigabyte price rather than another quote.

Enterprise Security is two editions, and neither has a price

Essentials is the SIEM, and Premier adds SOAR, user and entity behavior analytics, and automated threat analysis, so quote the higher edition only when those modules have to live in the app. Both editions include artificial intelligence, threat intelligence, Detection Studio, and exposure analytics, so the shared detection content is not the price gap. Both buttons say get a quote on Splunk Cloud or a self-managed stack.

The app does not buy more data, which breaks a "SIEM plus ingest" line on the order form. Splunk's Enterprise Security licensing page, updated 21 July 2026, calls it a premium app that needs Splunk Enterprise or Splunk Cloud Platform with a daily indexing or vCPU license. A 1 GB daily indexing license plus Enterprise Security still ingests 1 GB, so you can search that data in the app and you do not receive extra ingestion. Sales sets the app price on a platform you still have to size, and pricing only the app under-buys the meter.

SIEM trials come from a sales representative, not from the download button, so you cannot start a detection proof yourself. Essentials runs for 30 days and Premier for 90 days. After expiry, Mission Control, the Detection Editor, and Content Management are blocked, and a Premier trial also blocks UEBA, and an Essentials customer who trials Premier falls back to Essentials with data already processed kept, and the trial still ends in a quote.

Standalone SOAR is not the SOAR inside Premier, and the downloads page starts it free for up to 100 actions a day, while dedicated SOAR and Attack Analyzer have no paid price. A handful of enrichments can stay on that free cap. Playbooks inside the SIEM still require a Premier quote.

Four meters, and the SIEM sits on one of them

Activity-based pricing meters ingest and search together, which fits an unpredictable workload and still has no public unit price you can multiply. The pricing models page offers it on Splunk Cloud Platform for unpredictable workloads, and the main pricing page also lists it for Enterprise Security. Skip it if you wanted a daily gigabyte you could budget from a card.

Cloud Flex lets you move spend across Platform, Security, Observability, AI, Storage, and Federated Search without a new procurement cycle. No fee for that move is printed, and the page does not say every contract includes it. Do not plan to shift observability spend into the SIEM later unless the order names Flex.

Workload pricing charges for compute and storage, not a daily gigabyte cap, which suits heavy search on modest ingest. Cloud workload uses Splunk Virtual Compute (SVC) units for compute, memory, and I/O, driven by search count, search weight, and index volume, while on-prem workload uses vCPUs. The Cloud Platform service details, updated 26 June 2026, say a workload subscription does not meter ingestion. You add data and searches until the SVC entitlement is full, then buy more, and storage is a separate block. Retain more than you bought and the service expands, with overages under Splunk's general terms rather than a dollar rate on the pricing page, while a hard daily cap belongs on the ingest meter.

Ingest pricing charges by gigabytes indexed per day, and extra users or heavier search do not cost more, which is the opposite of the workload meter. Cloud ingest is an annual subscription, and on-prem ingest is a term license. Included SVC tops out at 1 SVC for every 10 GB a day. Enterprise Security adds another 1 SVC per 10 GB of licensed peak daily ingest, and IT Service Intelligence adds 1 SVC per 20 GB. Those ratios are bundled compute, not a price, and Splunk says the ratio can change.

Entity pricing is the annual host card used for Observability Cloud and AppDynamics, and it is the only meter with a printed starting rate. Eligible Cisco telemetry is a weight, not a dollar discount: Cloud Platform bills it at 0.5x, and Splunk Enterprise calls the same concession a 50% weighted ingest rate. It applies to eligible Cisco sources only, so a mixed estate still pays full weight on the rest.

Overages are billed only when you consistently exceed purchased ingestion or storage, and an incident spike can run past the subscription without an automatic penalty. "Consistently" is never defined, and no overage rate is printed. Capacity changes go through the Splunk Support Portal, volume discounts exist while the list rates do not, and premium support has no public price. Standard support, including major and minor updates, is already included.

Printed rates: observability, AppDynamics, and On-Call

Every Observability tier still has a get-a-quote button beside the starting rate, so the printed figure is a floor, not the invoice. Infrastructure is host monitoring, log connect, network, and uptime checks, which is enough when you only need the host layer. App & Infra adds APM and synthetic API checks, and End-to-End adds real user monitoring and browser synthetics. Database monitoring and Secure Application say contact us, with no price, so the top printed tier is not a complete card.

Agent Observability prices spans rather than detections, starting at $100 a month per 1.2 million spans a year, billed annually, with 500 million Luna tokens and 5 Luna fine-tuning runs a year, and anything past that allowance has no printed rate. It sells in Observability Cloud and self-hosted, and a SIEM order does not include it, so keep it out of the detection budget.

AppDynamics changes the unit mid-table, which is how a host-count estimate goes wrong if one rate is applied to every row. Infrastructure is $6 per vCPU a month on the table, while the blurb above it says the same figure per CPU core, and Premium and Enterprise then switch to a host price, so confirm the unit before you multiply. Add-ons apply to every edition and are billed annually: application security at $13.75 per CPU core a month, real user monitoring at $0.06 per 1,000 tokens a month, browser synthetics at $12 per test location a month, and SAP at $95 per CPU core a month. SAP on a large core count can exceed the host subscription, and these cards price application performance rather than detection.

On-Call is the per-seat product, and the printed rate stops at the seat cap, so a larger rotation has no public number to multiply. The downloads page offers a short trial inside that same cap. IT Service Intelligence has no list price either: it is workload or ingest, it still needs a platform license, and it is not a stand-in for Enterprise Security.

What the printed host and seat floors cost

These totals multiply the starting annual rates on the cards above. They are not a quote, because volume discounts, tax, premium support, and every unpriced add-on sit outside the arithmetic. The host count in the table is the scenario, and the same count of vCPUs is a different bill, since only the AppDynamics Infrastructure row uses processors.

40 hosts, or 10 On-Call seats, license floor	Unit on the card	Year, our arithmetic
Observability Cloud Infrastructure	$15 x 40 hosts x 12	$7,200
Observability Cloud App & Infra	$60 x 40 hosts x 12	$28,800
Observability Cloud End-to-End	$75 x 40 hosts x 12	$36,000
AppDynamics Infrastructure	$6 x 40 vCPUs x 12, not 40 hosts	$2,880
AppDynamics Premium	$33 x 40 hosts x 12	$15,840
AppDynamics Enterprise	$50 x 40 hosts x 12	$24,000
Agent Observability, one span allowance	$100 x 12, for 1.2 million spans a year	$1,200
On-Call, at the printed seat cap	$5 x 10 users x 12	$600

End-to-End is five times the Infrastructure year at this host count, and the gap is APM, API synthetics, real user monitoring, and browser synthetics, not more detection. It is not a SIEM, so a SOC still needs an Enterprise Security quote sized to the platform meter.

Ingest-based Splunk Cloud includes searchable storage for up to 90 days of uncompressed data. The service details use 100 GB a day as the example, which is 9,000 GB, or 9 TB, of Dynamic Data Active Searchable storage. Workload plans buy storage blocks instead of receiving that inclusion. Extra searchable storage and archive sell in 500 GB increments, with no public price, and archive restores are capped at 10% of searchable storage unless you buy more, so price archive before you sign.

Raw data filtered out before the indexing pipeline does not count against an ingest license, and Splunk measures raw bytes at the pipeline rather than compressed size on disk. The pricing page points at ingest and edge processors as that filter, which is the lever that shrinks a daily gigabyte bill. The SIEM cost guide covers volume and hot versus cold retention before you open the quote form.

Cyberpresso sends a daily brief on the threats a SOC has to price before a Splunk renewal. Subscribe here.

The free license is one box, with alerting off

The Free license does not expire, and it is the wrong production SIEM, because a queue needs alerts and separate users. The Free license page, updated 17 May 2026, allows 500 MB indexed a day on one standalone instance, and Splunk says that volume uses around 7 GB of storage a month. Alerting is off, there is no login, and anyone who can reach the instance is admin, so you cannot separate analysts from the box.

Users, roles, distributed search, clustering, deployment management, report acceleration, and ingest actions are unavailable. Forwarding works to other Splunk instances, not to non-Splunk software over TCP or HTTP, so it cannot feed another vendor's SIEM. If that cap is the actual requirement, use the free SIEM guide.

Three warnings in a rolling 30-day window disable search while indexing continues, warnings last 14 days, and there is no reset license, so a noisy week can leave the free box write-only.

A new install starts on an Enterprise Trial of 60 days, not on Free, and you can switch before it ends. Switching drops alerts, user accounts, and knowledge objects that were not already shared globally. The Splunk Cloud trial is 14 days at up to 5 GB a day of your own data, and Observability Cloud, including infrastructure, APM, and real user monitoring, runs the same length. No credit card is required, and none of these trials is an Enterprise Security license.

When search stops, and when it does not

A day over an ingest cap is a warning, counted midnight to midnight on the license manager's clock, and you cannot un-index the bytes. The license violations page draws the line at 100 GB a day. At that volume or higher, warnings are issued and search stays on. Under that line, 45 warnings in a rolling 60-day window block search, including scheduled reports and alerts, while indexing continues and internal indexes stay searchable. Search returns only with a reset license from sales.

If the stack is split into pools, only the pool that crosses that warning count loses search. A vCPU infrastructure license, the on-prem workload meter, does not currently violate. A license peer that cannot reach the manager for 72 hours is put in violation anyway, and search on that peer stops until the link returns, which means a network cut can look like a license breach. An ingest stack under the line can lose search after a noisy month. A cloud workload stack does not trip that count: it slows when SVC runs out, then needs more SVC or more storage, not a reset from sales.

What the quote has to name

Name the meter, the edition, and the retention, because activity-based, workload (SVC or vCPU), or ingest in GB a day changes the bill more than the edition name does. Take Premier only when SOAR, UEBA, or automated threat analysis has to live in the app, and stay on Essentials when those modules live somewhere else. Ingest cloud includes the searchable window described above, while workload bills storage as its own blocks and leaves archive as another unpriced line.

Ask which sources count as the Cisco weight already described, and make the order pick one overage rule, because the public FAQ and the admin manual do not describe the same event. Premium support is its own line if you want it, and standard support is already included. Ask whether Cloud Flex is on this contract before you assume budget can move from Observability to Security.

A platform-only quote is log analytics, and detection shows up only when Enterprise Security is its own line. If the gap is a night shift, compare MDR services before you buy Premier and still hire one. Case tools outside Splunk SOAR sit on the incident response list. If you need a printed ingest rate before the call, start with the Splunk alternatives. Packet and flow data belongs on the network security monitoring list, and exposure analytics on Essentials is not a vulnerability program. Keep a scanner you already pay for on the threat detection tools list until the quote says otherwise.

How we priced this

We read Splunk's pricing page, the pricing models page, the downloads page, the Cloud Platform trial page, the Enterprise Security licensing page, the Free license page, the license violations page, and the Cloud Platform service details on 17 October 2026. The host-count and seat-cap totals are our multiplication of the starting annual rates. They exclude tax, volume discounts, premium support, and every product whose card says get a quote.

Enterprise Security, Splunk Cloud Platform, Splunk Enterprise, paid SOAR, Attack Analyzer, and IT Service Intelligence do not publish a price, so this page does not invent one. Louis Corneloup, founder of Toolradar and Dupple, edited the piece. The method is on how we rate, and corrections sit in the editorial policy, so re-check the order form before anyone signs it.

FAQ

How much does Splunk cost in 2026?

Enterprise Security Essentials and Premier do not publish a price, and neither do Splunk Cloud Platform or Splunk Enterprise. The printed starting rates are Observability Cloud Infrastructure at $15 per host a month, App & Infra at $60, and End-to-End at $75, all billed annually. On-Call starts at $5 per user a month, billed annually, for up to 10 seats, and AppDynamics Infrastructure starts at $6 per vCPU a month, also billed annually. Those host and seat floors are not an Enterprise Security quote.

Does Splunk Enterprise Security charge per seat or per GB?

Neither rate is public, so a per-seat calculator will not produce a Splunk number. Enterprise Security is a premium app on a platform license, and a 1 GB daily license plus the app still ingests 1 GB. The meter is activity-based, workload (SVC in cloud, vCPU on-prem), or ingest in GB a day, and that choice moves the bill more than the edition name. Users on Cloud Platform and Splunk Enterprise are unlimited, and the only per-user price belongs to On-Call, which stops at the printed seat cap.

Is there a free Splunk plan?

Yes, and the cap keeps it in a lab rather than on a detection queue. The Free license indexes 500 MB a day on one standalone instance, does not expire, and turns alerting off. There is no login and no way to add users, so anyone who reaches the box is admin. Three warnings inside the warning window disable search while indexing continues, with no reset license to buy search back. Cloud, install, and SIEM trials are separate and do not turn this box into Enterprise Security.

What do 40 hosts cost on Observability Cloud?

At the printed annual floors, 40 hosts are $7,200 a year on Infrastructure, $28,800 on App & Infra, and $36,000 on End-to-End. The same host count on AppDynamics Premium is $15,840, and the same count of vCPUs on AppDynamics Infrastructure is $2,880, so those rows do not share a unit. On-Call at the printed seat cap is $600 a year, and one Agent Observability span allowance is $1,200 a year. None of these figures is an Enterprise Security quote.

What happens if you exceed a Splunk ingest license?

Under 100 GB a day, 45 warnings in a rolling 60-day window block search, including alerts, while indexing continues. At 100 GB a day or more, Splunk issues warnings and does not disable search. A vCPU infrastructure license does not currently violate, and a peer that loses the license manager for 72 hours loses search until it reconnects. Splunk's pricing FAQ bills overages only when you consistently exceed purchased ingestion or storage, and it prints no overage rate.

Does Enterprise Security include SOAR?

Premier includes SOAR and Essentials does not, and Premier also adds UEBA and automated threat analysis. Both editions include the SIEM, threat intelligence, Detection Studio, and exposure analytics. Standalone SOAR can start free for up to 100 actions a day, while the paid standalone product does not publish a price. After a Premier trial expires, UEBA is blocked along with Mission Control and the detection editor, so the trial will not keep those modules running.

How long are Splunk trials, and do they include the SIEM?

The Enterprise install trial is 60 days, Cloud Platform is 14 days at up to 5 GB a day, and Observability Cloud matches that length. AppDynamics is 30 days, and On-Call is the same short length inside the printed seat cap. No credit card is required, and none of those trials includes Enterprise Security, so a SIEM evaluation still needs sales to issue 30 days of Essentials or 90 days of Premier. A search head cluster hides the expiring-soon banner while still enforcing the expired block, so a clustered lab can look fine until the trial is already over.

Cite this: Cyberpresso, "Splunk Pricing 2026: Every Plan, Real Costs and Hidden Fees", October 2026.

A SOC pricing this license still has to track the intrusions that drive the renewal, and Cyberpresso covers both in one daily brief. Join at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.