Elastic Security vs Splunk Enterprise Security
Elastic Security publishes per-gigabyte rates for ingest and retention and lets you run the code yourself under an AGPL option. Splunk Enterprise Security shows no amounts and sells two editions through sales. Elastic N.V. lists an Amsterdam address, while Splunk LLC is a US company that describes itself as part of Cisco. If you want to read a rate before any conversation, only Elastic offers that.
Sebastiaan SmitsFounderVendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
Choose Elastic Security ifyou want published per-GB rates, you have search skills to run Elasticsearch yourself if needed, and you prefer a vendor with a Netherlands address.
Choose Splunk Enterprise Security ifyou already run Splunk for logs, you want SOAR and UEBA in an upper edition, and you accept requesting a quote from a vendor that Cisco owns.
Elastic Security and Splunk Enterprise Security side by side
| Elastic Security | Splunk Enterprise Security | |
|---|---|---|
| Our SIEM software rank | #3 of 12 | #11 of 12 |
| Established in | Netherlands | United States |
| List price, 2 November 2026 | Ingest from $0.09 per GB (Essentials) or $0.11 (Complete) on serverless; stored data from $0.017 or $0.019 per GB each month; the first 50 GB of egress costs nothing, after which $0.05 | Two editions, Essentials and Premier; the price comes from sales on request |
| Free tier | — | — |
| Open source | — | — |
| Self-hostable | — | Yes |
| Built for | Teams with search skills that want per-gigabyte billing and a self-run exit | Large security teams that already run Splunk for logs and want one vendor |
| Not for | Buyers who want a fixed annual price per organisation | Small teams that need a published price and a short setup |
Both are reviewed in full in our SIEM software ranking: Elastic Security and Splunk Enterprise Security.
Where they differ
Elastic Security 3 · Splunk Enterprise Security 1 · open 1- 01
Can you read a price?
On Elastic Security Serverless, ingest starts at $0.09 per GB for Essentials and $0.11 for Complete, and retained data starts at $0.017 or $0.019 per GB each month. Splunk puts a request-a-quote button on each edition and shows no figures. Only Elastic lets you open a budget from figures on the vendor's own page.
Edge: Elastic Security
- 02
How many meters apply
Elastic meters ingest, retention and egress as three lines, where egress is free for 50 GB and $0.05 beyond that. The per-endpoint fee was dropped on 23 March 2026. Splunk offers activity, workload or ingest pricing, and says eligible Cisco telemetry counts at a 50% weighted ingest rate on Splunk Cloud Platform. Both need sizing work, so we call it level.
Depends on the buyer
- 03
Features by tier
Prebuilt detection rules, machine learning, threat intelligence integration and Elastic Defend sit in Elastic's cheaper tier; the AI Assistant and entity analytics are reserved for Complete. Splunk keeps SOAR, UEBA and automated threat analysis for Premier. Both gate their extras, but Elastic puts endpoint protection in its entry tier.
Edge: Elastic Security
- 04
Running it yourself
You can run Elastic yourself, and the licence file in its repository gives an AGPL v3 choice next to SSPL and Elastic License 2.0. Splunk also lists self-managed and on-prem availability, but we saw no open licence for it. Elastic's route out of a vendor contract is better documented.
Edge: Elastic Security
- 05
Fit with an existing Splunk estate
Splunk's product page lists Federated Search and Risk-Based Alerting beside the SIEM, and the Cisco telemetry rate rewards firms that already send Cisco data to Splunk Cloud Platform. Elastic has no equivalent in the pages we read. For a Splunk shop, staying put has real facts behind it.
Edge: Splunk Enterprise Security
When neither fits
If you need a fixed price per organisation or a vendor that sells a finished appliance, look elsewhere. IBM QRadar licenses on events per second or managed servers, and Sumo Logic sells Cloud SIEM through its Enterprise Suite.
Elastic Security or Splunk Enterprise Security: questions
3 answersHow much does Elastic Security cost?
Per Elastic's serverless pricing page, Essentials starts at $0.09 per ingested GB plus $0.017 per retained GB monthly, and Complete at $0.11 plus $0.019. The first 50 GB of egress is free, then it is $0.05.
Is Splunk Enterprise Security priced publicly?
No. On Splunk's pricing page, both Essentials and Premier carry a quote button, and activity, workload and ingest are named as possible metrics.
Can I self-host Elastic Security?
Yes. Self-managed Elasticsearch is one of Elastic's deployment options, and AGPL v3 is among the licences in its repository.
Sources
Checked 2 November 2026- Elastic Security serverless pricing: ingest, retention and egress rates by tier; endpoint fee dropped 23 March 2026.
- Elastic Security SIEM page: self-managed as a deployment option.
- Elasticsearch repository LICENSE: the three licence options.
- Elastic privacy statement: Elastic N.V. address in Amsterdam.
- Splunk pricing page: edition names, quote buttons, metrics, Cisco telemetry weighting, Premier-only SOAR and UEBA.
- Splunk Enterprise Security product page: Federated Search, Risk-Based Alerting, SOAR, UEBA.
- Splunk About page: part of Cisco.