The typical searcher runs Splunk Enterprise Security today and is facing a renewal quote, a switch of licence metric, or the Cisco ownership question, and wants to know what else covers detection and audit evidence. They move to a cheaper open or published-price SIEM, to the SIEM that sits inside a cloud they already use, or to a vendor that bundles SOAR and behavioural analytics into one price.
Short answer: The first three alternatives to Splunk Enterprise Security in our SIEM software ranking are Graylog, Wazuh and Elastic Security. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category, wherever the category has them; the established names follow from place 4 in their ranked order. Choose Graylog if you want a stated entry price and can park low-value logs outside the licence. All 11 alternatives below are ranked products from Best SIEM Software in 2026, and each says where it differs from Splunk Enterprise Security.
Vendors can pay for visibility on this site; it never changes what we say
about a product. How that works.
Pricing: Essentials and Premier editions; activity, workload or ingest pricing; quoted by sales; cloud or on-prem
Established in: United States
Built for: Large security teams that already run Splunk for logs and want one vendor
Not for: Small teams that need a published price and a short setup
01
Why buyers look past Splunk Enterprise Security
01
A quote is the only price you will see
Splunk publishes no figure for Enterprise Security. Its pricing page lists activity-based, workload and ingest pricing, and both editions carry a Get a quote button. Budgeting therefore starts with a sizing conversation and a negotiation, which makes year-on-year comparison with a published per-GB rate impossible until you have the number in writing.
02
The edition split decides what you actually own
Splunk's comparison table shows SIEM, threat intelligence and Detection Studio in both Essentials and Premier, but SOAR, UEBA and Automated Threat Analysis only in Premier. A team that bought the SIEM and later needs automation or behavioural detection is looking at an edition change, not a switch it can flip.
03
A new owner and a platform that keeps widening
Splunk's pages now carry a Cisco Systems copyright notice and a Cisco Support link, and the pricing page offers a 0.5x weighted ingest rate for eligible Cisco telemetry. Buyers who chose Splunk as an independent log vendor often want to check whether the roadmap, bundling and renewal terms still suit them.
Licensed by events and flows or by managed servers; subscription or perpetual; quoted by sales; on-premises
On-premises SIEM licensed by events per second or managed servers
data must stay on premises and you prefer an events-per-second metric to a data-volume one
#12
03
What each one does differently
1
Graylog
United States · Graylog Open free with no volume cap; Enterprise and Security licences published by daily volume
Publishes starting prices where Splunk quotes: Graylog Security from $18,000 a year at 10 GB a day, Enterprise from $15,000. Standby data can be routed to a data lake before it counts towards the licence. Graylog Open is free under SSPL. It has no SOAR or UEBA line in its price list.
Switch from Splunk Enterprise Security if you want a stated entry price and can park low-value logs outside the licence.
Not stated by the vendor · Self-hosted software free; Wazuh Cloud tiers published by active agents; 14-day trial
Removes the licence fee: the platform is open source and you run the indexer, server and dashboard yourself, or take Wazuh Cloud. It combines endpoint agents with SIEM. The vendor pages state no country of establishment.
Switch from Splunk Enterprise Security if you have engineers to operate it and want endpoint monitoring and SIEM without a licence.
Netherlands · Serverless billed per GB ingested and retained, published; self-managed option; trial offered
The nearest in architecture, because it is search-based like Splunk, but billed per GB ingested and retained and published: from $0.09 ingest and $0.017 retention in Essentials. Since 23 March 2026 no per-endpoint fee applies. Egress past 50 GB is charged, and UEBA is only in the Complete tier.
Switch from Splunk Enterprise Security if you like a search-driven SIEM but want a per-GB price you can calculate yourself.
United States · Credit-based licensing; Essentials plan with trial, Enterprise Suite quoted; unlimited users
Sells through Sumo credits rather than Splunk's ingest or workload models, with unlimited users on both plans. Cloud SIEM sits in the Enterprise Suite, not the Essentials plan, and Enterprise pricing comes from sales. The credit and Flex mechanics need modelling before you can forecast a bill.
Switch from Splunk Enterprise Security if you want a cloud-only log and SIEM service with unlimited seats.
United States · Per GB of logs analysed per month, published; trial offered; volume discounts from sales
A SIEM that belongs to an observability suite: Cloud SIEM starts at $5 per GB analysed per month on annual billing, $7.50 on demand, with 12 months of analysis and retention. It only analyses logs you send to it. Workflows triggered by non-security events are billed separately.
Switch from Splunk Enterprise Security if your engineers already ship logs and traces to Datadog and security should share that pipeline.
United States · Consumption-based model with SOAR, UEBA and analytics not charged separately; sized in a demo
Sold as one cloud platform of SIEM, UEBA, SOAR and threat intelligence, and states that SOAR, UEBA and analytics carry no separate fees under its consumption model. It holds 365 days of searchable data. No prices are shown, so the number comes from a demo, and the platform is described as cloud-native.
Switch from Splunk Enterprise Security if behavioural analytics matters and you want it priced inside the SIEM, not as an edition.
United States · Cloud-native New-Scale platform or self-hosted LogRhythm SIEM; quoted by sales
Offers two product lines, a cloud-native New-Scale platform and a self-hosted LogRhythm SIEM, so one vendor covers a cloud and a self-hosted route. Both are sold through sales. Two lines mean you must choose a migration path, and no prices appear on its site.
Switch from Splunk Enterprise Security if you want behavioural analytics and may need the SIEM to stay in your own data centre.
United States · Essentials, Advanced and Ultimate packages; quoted per organisation; demo offered
Now sold as Incident Command in Essentials, Advanced and Ultimate packages. AI triage and deception technology start at Advanced, and XDR with embedded forensics at Ultimate. Its pages show a demo request and no prices. Alerts are enriched with exposure and vulnerability data.
Switch from Splunk Enterprise Security if you want detection tied to vulnerability and asset data and a three-step package ladder.
United States · Pay-as-you-go or daily commitment tiers; separate data lake tier; cost estimator offered
An Azure-native SIEM billed per GB on pay-as-you-go or commitment tiers from 100 GB a day, plus a cheaper data lake tier for high-volume logs. Other Azure services used with it are charged separately. From 31 March 2027 it is supported only in the Defender portal, not the Azure portal.
Switch from Splunk Enterprise Security if most of your estate already sits in Microsoft 365 and Azure and you will use the Defender portal.
United States · Standard, Enterprise and Enterprise Plus packages based on ingestion; quoted by sales
Packages named Standard, Enterprise and Enterprise Plus, based on ingestion, each with SIEM and SOAR and 12 months of hot data. Rule capacity rises from 1,000 single-event rules to 3,500, and UEBA starts at Enterprise. Prices are quoted by Google, and sizing comes before any budget.
Switch from Splunk Enterprise Security if you want SOAR included in the base SIEM package and a fixed year of searchable data.
United States · Licensed by events and flows or by managed servers; subscription or perpetual; quoted by sales; on-premises
Licensed by events per second and flows per minute, or by managed virtual servers, with subscription or perpetual terms for on-premises use. It runs as hardware or virtual appliances or a managed service. IBM publishes models, not amounts. Operating it is a team job, as with self-managed Splunk.
Switch from Splunk Enterprise Security if data must stay on premises and you prefer an events-per-second metric to a data-volume one.
When Splunk Enterprise Security is still the right choice
Stay on Splunk Enterprise Security when your searches, dashboards and detection content already live in SPL and the team that maintains them is the real asset. It also fits if you need Premier's SOAR and UEBA in one vendor's platform, or if you can use the weighted rate for the Cisco telemetry you already collect. Rewriting a mature detection library costs months, and a lower price per GB rarely repays that in the first year.
05
What moving off Splunk Enterprise Security involves
01
Count what the rewrite really contains
Export the list of saved searches, correlation searches, dashboards and scheduled reports that someone has opened in the last six months, and migrate only those. Detection logic written in SPL does not transfer; Sigma rules, which Graylog and IBM QRadar both state they support, give a vendor-neutral starting point for part of it.
02
Run both side by side through one audit cycle
Send a copy of the logs to the new SIEM while Splunk stays live, and compare alerts for a few weeks before you cut over. Keep Splunk long enough to satisfy retention rules, since archived events cannot be searched in the new tool, and confirm each candidate's export route before you sign.
06
Questions about replacing Splunk Enterprise Security
6 answers
Why is it hard to find the cost of Splunk Enterprise Security?
Splunk's pricing page says it offers activity-based, workload and ingest pricing, and both Enterprise Security editions, Essentials and Premier, lead to a quote. No price per GB or per workload is published for the product, so the figure comes from a sales conversation.
What is the difference between Essentials and Premier?
According to Splunk's own comparison table, both include SIEM, threat intelligence, Detection Studio and artificial intelligence features. Premier adds SOAR, user and entity behaviour analytics (UEBA) and Automated Threat Analysis. Check which of those you rely on before comparing to another vendor's price.
Which alternatives publish a price?
Of the eleven here, Graylog (from $15,000 and $18,000 a year), Elastic Security (per GB ingested and retained), Datadog ($5 per GB analysed on annual billing) and Microsoft Sentinel (pay-as-you-go and commitment tiers) publish rates.
Wazuh is free as software. The rest quote through sales or a demo.
Is there a SIEM without a licence fee?
Wazuh states that its platform is open source and installs for free, and Graylog Open is free under SSPL with no volume limit. Neither is free to run: you provide the servers and the people, or you buy the vendor's cloud service.
Can I keep my SIEM on premises?
Splunk Enterprise Security can be self-managed or on-prem. Among the alternatives, IBM QRadar is offered as hardware or virtual appliances, Exabeam sells a self-hosted LogRhythm SIEM, Graylog and Wazuh can be self-hosted, and Elastic offers self-managed Elasticsearch.
Datadog, Securonix, Sumo Logic and Google run in the vendor cloud.
Does a Microsoft Sentinel move have a deadline?
Microsoft's documentation says that from 31 March 2027 Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. Anyone choosing it should plan on the Defender portal from the start.
—
Sources
Checked 28 October 2026
Splunk Enterprise Security product page: Essentials and Premier editions, SOAR, UEBA and Automated Threat Analysis only in Premier, quote buttons, Cisco Systems copyright notice.
Splunk pricing page: activity-based, workload and ingest pricing, cloud and on-prem or self-managed deployment, 0.5x weighted ingest rate for eligible Cisco telemetry.
Graylog pricing: Open free under SSPL, Enterprise from $15,000 a year, Security from $18,000 a year, data lake routing, Sigma support.
Wazuh homepage: open source XDR and SIEM, free cloud trial offered.
Elastic security serverless pricing: per GB ingest and retention rates, egress after 50 GB, UEBA in Complete, end of per-endpoint fees on 23 March 2026.
Sumo Logic pricing: credit tiers and Flex, SIEM log ingest only in Enterprise Suite, unlimited users, free trial.
Datadog pricing: Cloud SIEM at $5 per GB analysed on annual billing, $7.50 on demand, 12 months analysis, separately billed workflows, discounts from 1.2B events a month.
Founder of The Knowledge Engineers and of 2 Steps Ahead, an AI search visibility agency. Editorially responsible for every page on this site; research and drafting are AI-assisted.
Written, edited and fact-checked by Sebastiaan Smits. Last reviewed
28 October 2026. How we review.
