Splunk Alternatives: 12 Options, Sorted by Who You Are

TL;DR

The right Splunk alternative depends on who you are, not on a ranking. Enterprise SOCs replacing Splunk Enterprise Security look at IBM QRadar, Microsoft Sentinel and Exabeam. Mid-market teams with a small security staff look at Graylog, Sumo Logic and Rapid7. EU organisations under NIS2, DORA and GDPR look at self-hosted options such as Guardsix, Graylog or Wazuh. Teams that were using Splunk for logs and uptime rather than security should evaluate Datadog, New Relic and Dynatrace instead of a SIEM. Teams with more time than budget can run Elastic Security or Wazuh for free.

One thing before the list. Every page that ranks for «splunk alternatives» today is written by a company that sells a SIEM, and every one of them puts its own product first. New Relic lists New Relic at number one. Palo Alto opens with Cortex XSIAM. SolarWinds ranks SolarWinds. Unihackers is a cybersecurity bootcamp. We sell training. We do not sell, resell or take referral fees from any of the twelve tools below, and nobody paid for a place on this page. That is the whole reason to trust the list, so I am stating it plainly.

I verified the licence, pricing model and ownership of every tool on the vendor's own pages during September 2026. Where a price is public, it is in the table. Where a vendor hides it behind «contact sales», the table says so.

The twelve at a glance

Why people leave Splunk

Three reasons come up in every conversation I have with hiring partners and with students who have run it in production. None of them is «Splunk is bad». Splunk is still the most requested SIEM skill in SOC analyst job postings, and our Splunk vs QRadar vs Sentinel comparison explains why learning SPL is still worth your time.

The first reason is the bill. Splunk's own pricing page now lists four models: activity-based (a dual meter on ingest and search), workload, ingest and entity. Four models means four ways to be surprised at renewal, and the page still does not print a number for Enterprise Security. Our SIEM pricing comparison models the same 50 GB per day workload across six platforms and shows how wide the gap gets.

The second reason is Cisco. Cisco completed the acquisition of Splunk on 18 March 2024. Two and a half years on the products are still sold separately, but the packaging has tilted: eligible Cisco telemetry lands in Splunk at a 0.5x weighted ingest rate, and Cloud Flex lets a customer move spend across the combined portfolio. If you own Cisco firewalls and switches, Splunk got relatively cheaper. If your stack is Palo Alto, Fortinet and CrowdStrike, you are subsidising somebody else's discount.

The third reason is that many teams never needed a SIEM. They bought Splunk to search application logs, and the security use case came later or never. For those teams the replacement is an observability platform, which is why this article has a dedicated block for Datadog, New Relic and Dynatrace.

The tool that replaces Splunk is the one that matches the team you actually have. A four-person security team that buys an enterprise SIEM ends up paying a licence to store alerts nobody reads.

If you need enterprise scale

You have a 24x7 SOC, auditors who ask for twelve months of retention, and more than 100 GB of security logs a day. Three tools compete for that seat.

1. IBM QRadar SIEM

QRadar is the tool most likely to already be in the building at a bank, a hospital group or a government ministry. Its licence is priced by events per second rather than by gigabyte, which is the single most important thing to understand about it: a steady, predictable log volume costs the same every year, and a sudden burst does not blow the budget the way it does on per-GB SIEMs.

Ownership changed in 2024, and this trips up a lot of comparison pages. Palo Alto Networks closed its acquisition of IBM's QRadar SaaS assets on 4 September 2024 and is steering those customers toward Cortex XSIAM. IBM kept QRadar SIEM on premises and still sells it with its NDR, UEBA and EDR add-ons. If someone tells you «QRadar is dead», they are describing the cloud edition.

Choose it if you run on-prem by policy, your log volume is stable, and out-of-the-box detections matter more than custom search. Skip it if you want a SaaS SIEM: that road now leads to Palo Alto, not IBM.

2. Microsoft Sentinel

Sentinel is the alternative with the most public pricing, so it is the easiest to model. On the Microsoft Sentinel pricing page the analytics tier costs $4.30 per GB pay-as-you-go in US regions, and commitment tiers run from $296 per day at 100 GB up to $102,600 per day at 50,000 GB. A 50 GB tier at $161.25 per day is in preview with promotional pricing through December 2026. Below that sits the data lake tier at $0.05 per GB ingested and $0.026 per GB per month stored, which is where you park firewall and proxy logs you rarely query. Microsoft 365 E5 customers get up to 5 MB per user per day of key security logs ingested free.

The catch is that Sentinel is the natural choice only if you already live in Microsoft. Its detections, identity signal and free ingestion all assume Entra ID and Defender. Bring a heterogeneous estate and you pay full price for every non-Microsoft source while your analysts learn KQL as a second query language.

Choose it if you are an M365 E5 shop and your identity provider is Entra. Skip it if your endpoints, cloud and identity are with three other vendors.

3. Exabeam New-Scale

Exabeam is the behavioural analytics option. Its pitch has always been UEBA: baseline every user and machine, score deviations, and surface the credential misuse and insider activity that signature rules miss. Exabeam and LogRhythm completed their merger on 17 July 2024 under the Exabeam name, which gave the company a self-hosted line (LogRhythm) alongside the cloud-native New-Scale platform. The New-Scale Fusion page states ISO 27001 and SOC 2 Type II compliance and lets you keep an existing SIEM and add New-Scale Analytics on top, a realistic path for a team that cannot rip out Splunk in one quarter. Pricing is not public.

Choose it if insider threat and credential compromise are your top detection gaps. Skip it if you want a simple, cheap log store; that is not what Exabeam sells.

If you are mid-market

You have between 200 and 2,000 employees, a security team of two to five people, and a budget that a finance director signs off personally. The enterprise tools above will drown you in features you cannot operate. These three are built for the team you have.

4. Graylog

Graylog has the clearest ladder of any vendor here, and the pricing page prints the numbers. Graylog Open is free, source-available under the SSPL, with no volume limit and community support. Graylog Enterprise starts at $15,000 per year and Graylog Security at $18,000 per year, both from 10 GB per day. Security adds MITRE ATT&CK-mapped detection rules maintained by Graylog, Sigma rule support, anomaly detection and automated case creation.

The limitation is that Graylog Open is a log manager, not a SIEM. The correlation engine, the detection content and the reports are all in the paid tiers. Graylog is also a self-hosted product first: you run OpenSearch or Elasticsearch and MongoDB underneath it, and you own that operational load.

Choose it if you want a fixed annual price, self-hosting, and a free tier to prove the concept on. Skip it if nobody on the team wants to run a search cluster.

5. Sumo Logic

Sumo Logic is the cloud-native option for teams whose infrastructure is already in AWS. Its pricing page is built on credits, and the Flex model inverts Splunk: $0 for ingest, with billing driven by how much data your queries scan, quoted at $3.14 per TB scanned on the low-usage profile. You can send everything and pay for what you look at.

Cloud SIEM is part of the Enterprise Suite, with ATT&CK coverage mapping, a rule tuning assistant and threat intelligence feeds. Deployment regions include Dublin and Frankfurt.

Choose it if your log volume is spiky and your searches are not, and your team is DevSecOps rather than a classic SOC. Skip it if you need a predictable invoice: consumption billing rewards discipline and punishes curiosity.

6. Rapid7 Incident Command

Rapid7 renamed and repackaged InsightIDR into Incident Command, sold in Essential, Advanced and Ultimate tiers priced per asset rather than per gigabyte. Every tier includes the SIEM, log management, user behaviour analytics, Rapid7's own agent, embedded threat intelligence and 90 days of log retention (13 months for alerts and audit). Higher tiers add EDR, NDR, deception and a hosted Velociraptor for forensics.

Per-asset pricing is the reason to look at it: a 500-endpoint company knows what it will pay next year, and a noisy firewall does not change the bill. The trade-off is retention. 90 days is short for compliance, and longer retention is an add-on.

Choose it if you want SIEM, EDR and vulnerability management from one vendor with one bill. Skip it if your auditors want a year of searchable logs by default.

If you need EU compliance

This block exists because none of the vendor listicles serves it. If you operate in the EU, three regulations shape the SIEM decision. NIS2 requires essential and important entities to log, detect and report incidents within 24 hours. DORA does the same for financial entities. GDPR Article 32 requires you to demonstrate that you protect personal data. All three are easier to evidence when the logs stay in your jurisdiction.

That does not rule out SaaS. Microsoft, Datadog, Sumo Logic and Elastic all offer EU regions. The question your DPO will ask is who can compel access to the data, and for a US-headquartered provider the answer involves the CLOUD Act regardless of where the disk sits. Self-hosted tools make that question go away.

7. Guardsix (formerly Logpoint)

Logpoint, the Copenhagen SIEM vendor, rebranded as Guardsix on 12 March 2026. The product page is unusually direct about who it is for: energy, healthcare, government and the MSSPs that serve them, with content packs mapped to NIS2, DORA and GDPR Article 32. It is self-hosted and air-gappable, and the company is EU-headquartered and EU-governed, so the CLOUD Act argument does not apply.

Pricing is per node, not per gigabyte, so adding a log source or extending retention does not raise the invoice. Prices are not public.

Two cautions. Guardsix is small next to the enterprise vendors, so the integration catalogue is thinner; expect to write parsers. And a sovereignty pitch can hide an ordinary SIEM behind a compliance story, so run the same detection-quality tests you would run on anyone else.

Choose it if sovereignty is a hard requirement and your team is lean. Skip it if your estate is mostly US SaaS whose logs are leaving the jurisdiction anyway.

The other EU-friendly options are already on this list. Graylog self-hosted keeps everything on your hardware. Wazuh, in the open source block below, does the same and adds the file integrity monitoring and configuration assessment that ISO 27001 auditors like to see. And if you are all-in on Azure, Sentinel with the EU Data Boundary is defensible; just get the data residency commitment in writing.

If you want observability, not SIEM

Search for «splunk alternatives» and half the results are observability vendors, because a large share of Splunk seats were never security seats. They were engineers searching application logs, and for them a SIEM is the wrong replacement. If your questions are «why is checkout slow» and «which deploy broke the API», this is your block.

8. Datadog Cloud SIEM

Datadog is the observability platform that grew a SIEM, and it is the one to evaluate if your engineering team already runs it. Cloud SIEM on the pricing page starts at $5 per GB analyzed per month billed annually, or $7.50 on demand, with 12 months of analysis and retention and more than 800 maintained detection rules. Underneath it, Log Management ingests at $0.10 per GB, and Flex Logs let you keep high-volume logs queryable at lower cost.

Two things to know before comparing it with Splunk. Datadog is priced per product and the products stack: infrastructure hosts, APM hosts, logs, then SIEM on top of logs. And it is SaaS only, which rules it out for the sovereignty cases above.

Choose it if you are consolidating monitoring and security telemetry on one platform your developers already open every day. Skip it if security is your only use case; a dedicated SIEM will give you deeper case management for the money.

9. New Relic

New Relic is the direct answer to «we used Splunk for application logs and it cost too much». The pricing page includes 100 GB of ingest per month free forever, then $0.40 per GB on Standard and Pro ($0.60 per GB with Data Plus for longer retention and compliance features). The second meter is users: basic users are free, core users are $49 a month, and full platform users on Pro are $349 a month on an annual commitment. That second meter is where budgets go wrong, so model users before you model gigabytes.

New Relic is not a SIEM. It has log management, alerting and application-layer vulnerability management, and nothing resembling case management or a detection rule library.

Choose it if you need APM, infrastructure and logs on one platform with a real free tier to start on. Skip it if anyone in the company expects it to replace a SIEM.

10. Dynatrace

Dynatrace is the enterprise observability option, and its log pricing is the most granular of the three. On the pricing page, Log Analytics on the pay-per-query model charges $0.20 per GiB to ingest and process, $0.0007 per GiB-day to retain and $0.0035 per GiB scanned to query. Hosts are metered separately at $7, $29 or $58 a month by tier. Everything lands in Grail, one data lakehouse for logs, traces, metrics and events, queried with DQL. Dynatrace also sells security analytics on the same data, aimed at cloud workload and application security rather than at running a SOC.

Choose it if you have thousands of hosts and want automatic topology and root-cause analysis with logs in context. Skip it if you are a fifty-host company; the platform assumes scale, and so does the sales process.

If you have more time than budget

The last two are open source in the strict sense. Both are free to run, both take a real engineer a real week to set up properly, and both are what our bootcamp students deploy in a home lab. Our guide to open source SIEM tools covers eight of them with hardware minimums from the official docs; these two belong on a Splunk shortlist.

11. Elastic Security

First, the fact that most ranking pages get wrong. In 2021 Elastic moved Elasticsearch and Kibana off Apache 2.0 to the SSPL and Elastic License 2.0, neither of which is OSI approved, and «ELK is no longer open source» became received wisdom. In September 2024 Elastic added the AGPLv3, an OSI-approved licence, as a third option. The Elastic licensing FAQ answers the question «Does this mean that Elasticsearch and Kibana are Open Source again?» with a one-word «Yes». The prebuilt distribution is still under the Elastic License 2.0; the source is under AGPLv3. Any comparison page that says otherwise has not been updated since 2023.

Elastic Security on a self-managed cluster is free and includes the detection engine, prebuilt rules, endpoint protection and case management. Serverless and hosted cloud options are billed on usage. The short version of «splunk vs elasticsearch»: Elastic gives you a search engine and a SIEM on top of it for the cost of hardware and skill; Splunk gives you a more polished SIEM for the cost of a licence.

Choose it if you have engineers who can run a cluster and you want the free path that scales to real production. Skip it if nobody can own Elasticsearch operations; an untuned cluster is the most expensive free software in security.

12. Wazuh

Wazuh calls itself the open source security platform, and it is the tool we see most often in student labs and small-company SOCs. It is licensed under GPLv2, costs nothing to run, and combines a SIEM with an agent that does file integrity monitoring, vulnerability detection, configuration assessment and active response. That agent is the reason to pick it over a pure log SIEM: for a company with 300 laptops and no EDR, Wazuh covers two gaps with one install. If you do not want to host it, Wazuh Cloud starts at $571 a month for up to 100 agents, $923 for 250 and $1,467 for 500, and the service is PCI DSS and SOC 2 audited.

The limits are real. Wazuh's detection content is rule-based and endpoint-centric; network and cloud detections take more work. And free is a licence price, not an operating cost: the Wazuh quickstart specifies 4 vCPU and 8 GiB for up to 25 agents, and someone has to patch and tune it.

Choose it if endpoints are your biggest blind spot and your budget is close to zero. Skip it if you need mature cloud and SaaS detections out of the box.

How to run the shortlist

Pick the block that describes you, take the tools in it, and run the same test on each: ship one week of your real logs, write five detections that matter to your business, and time how long an analyst takes to close an alert end to end. Ignore the datasheet feature counts. The differences that matter show up in that week.

Then price the year at today's volume and at double it, because the models diverge under growth. Per-GB tools (Sentinel, Datadog, New Relic) scale with your data. Per-EPS and per-node tools (QRadar, Guardsix) scale with your infrastructure. Per-asset tools (Rapid7) scale with your headcount. Consumption tools (Sumo Logic, Dynatrace) scale with how often your team looks. Open source scales with the salary of the person who runs it.

Is security the use case?

→

No. Datadog, New Relic or Dynatrace

→

Yes. Pick by team size and jurisdiction

If you are reading this because you want to work in a SOC rather than buy one, the tool choice matters less than you think. Every platform here searches logs, correlates events and raises alerts. Learn one deeply and the second takes weeks instead of months. Our guide on how to become a SOC analyst explains which ones to learn first and in what order.

FAQ: Splunk alternatives

What is the best Splunk alternative? There is no single best one, which is why this article sorts twelve tools by buyer instead of ranking them. For an enterprise SOC replacing Splunk Enterprise Security, the shortlist is IBM QRadar, Microsoft Sentinel and Exabeam. For a mid-market team with two or three security people, Graylog, Sumo Logic and Rapid7 fit better. For EU compliance work, self-hosted tools such as Guardsix, Graylog or Wazuh keep data in your jurisdiction. If you used Splunk for application logs and uptime rather than security, Datadog, New Relic or Dynatrace are the direct replacements.

Is there a free Splunk alternative? Yes, several. Elastic Security is open source again since Elastic added the AGPLv3 licence in September 2024, and it runs a full detection engine on your own hardware. Wazuh is open source, free to run and includes agents, file integrity monitoring and vulnerability detection. Graylog Open is free under the SSPL with no volume limit. Splunk's own free edition caps ingest at 500 MB per day, which is enough for a home lab but not for a company. Free means free licence, not free operation: each of these needs hardware and someone who knows how to tune it.

Is Elasticsearch open source in 2026? Yes. In 2021 Elastic moved Elasticsearch and Kibana from Apache 2.0 to the SSPL and Elastic License, neither of which is OSI approved, and many comparison pages still repeat that. In September 2024 Elastic added the AGPLv3, an OSI-approved licence, as a third option. Elastic's own licensing FAQ answers the question «Does this mean that Elasticsearch and Kibana are Open Source again?» with «Yes». The prebuilt distribution you download is still under the Elastic License 2.0; the source code is available under AGPLv3.

Splunk vs Datadog: which one should I choose? They solve different problems. Splunk Enterprise Security is a SIEM: detection rules, case management, threat intelligence and long retention of security logs. Datadog started as infrastructure and application monitoring and added Cloud SIEM on top of its log platform. If your engineering team already runs Datadog for APM and you need security detections on those same logs, Datadog Cloud SIEM at $5 per GB analyzed is the cheaper path. If you are building a SOC that answers to auditors, Splunk or one of the dedicated SIEMs in this list will serve you better. Many companies run both.

What changed at Splunk after the Cisco acquisition? Cisco closed the acquisition on 18 March 2024. Splunk Cloud and Splunk Enterprise are still sold as separate products, and the pricing page now lists four models: activity-based, workload, ingest and entity. The visible change is the packaging incentive: Splunk ingests eligible Cisco telemetry at a 0.5x weighted rate and pools spend across the portfolio through Cloud Flex. If you own Cisco firewalls and network gear, Splunk got relatively cheaper. If you do not, the economics are the same as before, which is why many teams are reading articles like this one.