Splunk vs Microsoft Sentinel 2026: SIEM Cost at 5, 50 and 200 GB a Day

Microsoft Sentinel is the SIEM you can price before talking to sales; Splunk is not. Sentinel's analytics tier lists $4.30 per GB pay-as-you-go, or $548 a day for a 200 GB commitment, while Splunk Enterprise Security and Splunk Cloud are quote-only. On those listed rates, Sentinel costs about $645 a month at 5 GB a day and $16,440 at 200 GB, which is the number a Splunk quote has to beat.

Sentinel rates are Microsoft's listed US East prices, read on Microsoft's Sentinel pricing page and in the Azure retail price list for Sentinel on 19 October 2026. Splunk's terms come from Splunk's pricing page, read the same day. Our view: for a Microsoft 365 shop, Sentinel is the default to price first, and Splunk earns its place where the log estate is mixed, on premises or already built around Splunk searches.

Toolradar data: Splunk is listed as an alternative to 60 tools, the most among the 26 tools in its Toolradar category, and Microsoft Sentinel to 25, as of October 2026 (Splunk on Toolradar, Sentinel on Toolradar). Toolradar is the software directory we run. Splunk is still the SIEM buyers measure others against, which is part of why it can sell without a price list.

At a glance

The table shows the core asymmetry: Microsoft prints a rate card down to the meter, so a security lead can model the bill from log volume alone, before any vendor call. Splunk sells Enterprise Security in two editions, Essentials and Premier, plus the Splunk platform underneath it, and asks for a quote on both.

How much does Microsoft Sentinel cost at 5, 50 and 200 GB a day?

We priced the analytics tier at three daily volumes, as our arithmetic on Microsoft's listed rates: a month is 30 days and a year is 365. Taxes, enterprise agreements and Azure services outside Sentinel are excluded.

Commitment tiers do the heavy lifting. At 200 GB a day the tier cuts the monthly bill by about 36% against pay-as-you-go, or $9,360 a month. Usage above a tier is billed at the same discounted rate, tiers can be raised at any time, and they can only be lowered after 31 days, so commit to the volume you are sure of, not your peak.

The 50 GB tier is a promotion. Microsoft offers it to customers who sign up between October 1, 2025 and December 31, 2026, and holds that promotional price until March 31, 2027. A team at 50 GB a day should budget for the price to change after that date, and check whether the regular 100 GB tier at $296 a day still beats pay-as-you-go for its volume.

Two discounts can shrink the small-volume number to near zero. Some Microsoft data sources are free to ingest, including Azure Activity logs, Office 365 audit logs and security alerts from Microsoft Defender products. Microsoft 365 E5, E7, A5, F5 and G5 customers also get a grant of up to 5 MB per user per day of Microsoft 365 data, so on our arithmetic 1,000 such users cover the whole 5 GB scenario.

The data lake changes the 200 GB math

Sentinel now has two storage tiers. The analytics tier runs detections and alerts at the rates above; the data lake tier holds high-volume logs such as firewall, network and proxy data for hunting and compliance, at $0.05 per GB to ingest and $0.026 per GB a month to store, with separate meters for processing and queries.

On our arithmetic, a 200 GB day split as 50 GB of identity, endpoint and threat intelligence data into the 50 GB tier and 150 GB of firewall logs into the lake costs $168.75 a day before lake storage, processing and queries. That is under a third of the 200 GB tier's daily fee, which is the difference between a SIEM line item and a SIEM project. The catch is that Microsoft positions the lake for investigations, querying and compliance, while alerts and real-time detections run on the analytics tier, so this split only works if your detections do not depend on the logs you move.

Splunk offers its own levers for the same problem: Ingest and Edge Processors filter data before it is billed, and Federated Search and Machine Data Lake analyze data where it lives. Splunk prints no rate for those either, so the savings show up only in a quote.

How Splunk prices Enterprise Security

Splunk lets you choose among activity-based, ingest and workload pricing on Splunk Cloud, and between ingest and workload pricing on Splunk Enterprise, all with unlimited users. Enterprise Security comes in Essentials and Premier editions, both quote-only, and Cisco Talos threat intelligence is included at no additional cost.

Two terms matter for a cost comparison. Eligible Cisco telemetry counts at a 0.5x weighted ingest rate, which favors a Cisco-heavy network. And Splunk says it charges for overages only when you consistently exceed the ingest or storage capacity you bought, which is gentler on a one-week spike than Sentinel's per-GB meter.

How to compare a Splunk quote with Sentinel: ask Splunk for an ingest-based price at your real daily volume, convert it to a cost per GB a day, and add the infrastructure cost if you run Splunk Enterprise yourself. Then set it against the Sentinel row for the same volume. At 200 GB a day, a Splunk deal has to come in under about $200,020 a year, our arithmetic for 365 days on the 200 GB tier, to beat Sentinel on list price.

Cyberpresso sends a daily brief on the detections, incidents and tooling changes SOC teams have to act on. Subscribe here.

Where Microsoft Sentinel wins

Sentinel wins on predictability and on Microsoft data. Every meter is published, a 31-day trial covers 10 GB a day, and 90 days of analytics retention come included, so a finance team can approve a budget from a log volume estimate. The free Microsoft data sources and the Microsoft 365 data grant mean an organization already on Microsoft 365 E5 can bring its own identity and email telemetry in for little or nothing.

It also scales cheaply when you are willing to sort logs. The data lake tier makes it affordable to keep noisy network data for investigations, while the analytics tier stays reserved for data that drives detections.

The weakness is lock-in to Azure and to Microsoft's meter design. Sentinel runs only in Azure, commitment tiers apply per workspace and cannot be shared across workspaces or subscriptions, and other Azure services such as Logic Apps, used for automation, are billed separately. Our Microsoft Defender for Business review and CrowdStrike vs Microsoft Defender comparison cover the endpoint side of that stack.

Where Splunk wins

Splunk wins where deployment flexibility matters. Splunk Enterprise runs in a private cloud, on premises and in air-gapped environments, which Sentinel cannot do, and that alone settles the choice for some regulated and government teams. An existing Splunk shop also keeps its searches, dashboards and detection content by staying, which avoids a migration project that no list price captures.

It also gives buyers more ways to shape the bill. Choosing workload pricing instead of ingest pricing decouples cost from data volume, and the 0.5x weighting rewards Cisco telemetry. For a team ingesting large volumes but searching them lightly, that choice can matter more than any list price.

The weakness is the opacity. With no published price for Enterprise Security or Splunk Cloud, you cannot model Splunk's cost without a sales cycle, and every comparison depends on the discount you negotiate. Our Splunk pricing page lists what Splunk does publish, and the Splunk review covers the product in depth.

Which should you choose?

Pick Microsoft Sentinel if your identity, email and endpoints run on Microsoft, if you need a budget you can compute from log volume, or if your volume is small enough that pay-as-you-go plus the free data sources keeps the bill low. Route bulk network logs to the data lake once you pass the 50 GB range.

Pick Splunk Enterprise Security if you must run on premises or air-gapped, if your SOC already depends on Splunk searches and content, or if a heavy Cisco network makes the weighted ingest rate attractive. Get the quote at your real daily volume and hold it against the Sentinel figure for the same volume before you sign.

For the wider field, see our best SIEM tools ranking, the Splunk alternatives list, free SIEM tools our explainer on how much a SIEM costs and our guide to AI in the SOC. Toolradar's Sentinel vs Splunk comparison carries the directory view.

How we compared them

Louis Corneloup, founder of Dupple and Toolradar, wrote this comparison for SOC and security leads. We read Microsoft Sentinel's tiers, promotion terms and FAQ on Microsoft's Sentinel pricing page, its listed rates in the Azure retail price list, billing rules in Microsoft's Sentinel billing documentation and the data grant on the Microsoft 365 benefit offer page, and Splunk's pricing models on Splunk's pricing page, all on 19 October 2026. Monthly and yearly figures are our arithmetic on Microsoft's US East list rates. Neither product was deployed for this page; it compares published pricing.

FAQ

Is Microsoft Sentinel cheaper than Splunk?

On list price it cannot be settled, because Splunk publishes no price for Enterprise Security or Splunk Cloud. What can be settled is Sentinel's side: $645 a month at 5 GB a day on pay-as-you-go and $16,440 a month at 200 GB on the commitment tier, by our arithmetic on Microsoft's listed rates. A Splunk quote below those figures for the same volume is cheaper.

How much does Microsoft Sentinel cost per GB?

The analytics tier costs $4.30 per GB on pay-as-you-go in US East. Commitment tiers lower the effective rate: the 200 GB tier at $548 a day works out to $2.74 per GB, and the promotional 50 GB tier to about $3.23. The data lake tier costs $0.05 per GB to ingest plus $0.026 per GB a month to store.

Does Splunk publish its prices?

Not for its SIEM. Splunk Enterprise Security Essentials and Premier, Splunk Cloud Platform and Splunk Enterprise are all sold through a quote, with a choice of activity-based, ingest or workload pricing. Splunk does publish free trials and some observability rates, which our Splunk pricing page lists.

Is there a free tier for Microsoft Sentinel?

There is a 31-day free trial covering 10 GB a day in the analytics tier. Beyond that, some sources are always free to ingest, such as Azure Activity logs, Office 365 audit logs and Microsoft Defender alerts, and Microsoft 365 E5, E7, A5, F5 and G5 customers get up to 5 MB per user per day of Microsoft 365 data at no charge.

Can Sentinel run on premises like Splunk?

No. Sentinel is an Azure service, and its logs live in an Azure Monitor Log Analytics workspace or the Sentinel data lake. Splunk Enterprise runs in a private cloud, on premises or air-gapped, which is the main reason regulated teams that cannot send logs to a public cloud stay on Splunk.

Cite this: Cyberpresso, "Splunk vs Microsoft Sentinel 2026: SIEM Cost at 5, 50 and 200 GB a Day", November 2026.

Cyberpresso covers the detections, incidents and tooling changes SOC leads have to act on, in one daily brief. Join at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.