Splunk pricing in 2026: per-GB list prices, Cloud vs Enterprise, and real spend
The Splunk pricing reference, built on Splunk's filed end-customer list prices: per-GB rates by volume band for Splunk Cloud, Enterprise Security and the self-managed term licence, SVC workload pricing, Cloud vs Enterprise trade-offs, and five cost scenarios from startup to MSSP. Updated October 2026.
Page updated 13 October 2026/First published 7 April 2026
splunk.com publishes no per-GB price. Its platform pricing page, checked 13 October 2026, lists the models (activity-based, workload, and ingest, plus the Enterprise Security Essentials and Premier editions) and routes every one of them to a quote. The list prices on this page are Splunk's own end-customer price list as filed on the UK Digital Marketplace under G-Cloud 15 (Softcat, pricing document dated 27 January 2026) and, for the Enterprise term licence, on AWS Marketplace. They are list, not what customers pay after negotiation.
Splunk pricing calculator
Splunk Cloud bills per GB ingested per day on a list rate that tapers with commit volume: $1,265 per GB/day/yr in the 50 to 99 GB/day band, $2,049 at 5 to 9 GB/day and $765 at 5,000 GB/day and above. Enterprise Security is a separate per-GB line sold from 50 GB/day, which adds 96 percent at that band and 55 to 75 percent above it. Multi-year Enterprise Agreements above $500K list see 25 to 40 percent off. Set your daily volume, edition and the ES add-on below for the annual list figure.
Enterprise is the term licence only. Add hardware and an admin engineer for a self-managed total.
Without ES or equivalent custom content you have log analytics, not a SIEM. ES is priced from 50 GB/day; the ES rate here is the Cloud subscription card.
Splunk Cloud Platform at $1,265 per GB/day per year in the 50 GB/day band, plus Enterprise Security at $1,214.4 per GB/day per year. Add storage, deployment services and analyst staffing for full TCO.
Splunk list prices by volume band
USD per GB/day per year, Standard Success Plan, as filed. Splunk Cloud Platform subscription (SE-S-CLD-ST), Enterprise Security subscription (ES-S-CLD-ST) and the self-managed Splunk Enterprise term licence (SE-T-LIC-ST).
| Volume band | Splunk Cloud base | Enterprise Security add-on | Enterprise term (self-managed) |
|---|---|---|---|
| 5-9 GB/day | $2,049.30 | Not sold below 50 GB/day | $1,518.00 |
| 10-19 GB/day | $1,745.70 | Not sold below 50 GB/day | $1,265.00 |
| 20-49 GB/day | $1,518.00 | Not sold below 50 GB/day | $1,138.50 |
| 50-99 GB/day | $1,265.00 | $1,214.40 | $961.40 |
| 100-199 GB/day | $1,012.00 | $759.00 | $759.00 |
| 200-499 GB/day | $974.05 | $588.23 | $733.70 |
| 500-999 GB/day | $851.00 | $483.00 | $644.00 |
| 1,000-1,999 GB/day | $822.25 | $465.75 | $621.00 |
| 2,000-4,999 GB/day | $793.50 | $448.50 | $598.00 |
| 5,000-9,999 GB/day | $764.75 | $431.25 | $575.00 |
Source: Softcat G-Cloud 15 pricing document, Splunk End Customer Pricelist (EMEA distributor), 27 January 2026, read 13 October 2026. The Enterprise term ladder is the same on the AWS Marketplace BYNET listing (12-month contract; its 1 GB/day and 2-4 GB/day rows are $2,277 and $1,897.50). Premium Success Plan rows run about 15 percent higher. Encryption-at-rest, compliance and FedRAMP variants carry their own ladders.
How Splunk pricing actually works
Splunk has been a Cisco company since Cisco closed its $28 billion acquisition in March 2024. Pricing mechanics below are unchanged so far, but expect Splunk to surface in Cisco enterprise agreements and bundle negotiations over time, which can change the leverage available at renewal.
Splunk's headline model is per-GB ingested per day, billed monthly or annually depending on contract. The meter starts the moment a log line crosses the forwarder. Compression in storage does not reduce the bill: 1 GB ingested is 1 GB billed regardless of how it sits at rest. That single rule is the single biggest reason Splunk bills run away from forecast.
Workload-based pricing was opened to all Splunk Cloud customers at .conf21 in 2021 and has since become the default-recommended model on new Cloud agreements. It swaps pure ingest for a Splunk Virtual Compute (SVC) unit. SVCs measure search compute, not raw ingest. For predictable, search-heavy workloads this saves 15-25 percent. For ingest-heavy compliance use cases it can run slightly higher than the per-GB model. Read your contract carefully.
On top of base ingest, Splunk sells premium apps that most genuine SIEM deployments require. Enterprise Security (ES) is a separate per-GB line: at 50 to 99 GB/day its list rate ($1,214.40) is 96 percent of the base rate, so the licence roughly doubles; from 100 GB/day the ES rate drops faster than the base rate, adding 75 percent at 100 to 199 GB/day and about 60 percent at 200 GB/day and above. IT Service Intelligence (ITSI) is a separate line. Splunk SOAR is sold separately again. Stack the add-ons and the true Splunk SIEM bill runs roughly 2 to 3 times the base ingest list price.
Splunk Virtual Compute (SVC): the filed per-SVC price
Splunk does not publish SVC prices on splunk.com; the calculator at splunk.com/en_us/products/pricing/pricing-calculator.html sizes SVCs from your inputs and routes to sales. The filed G-Cloud 15 list does carry a per-SVC rate, which is the figure below.
Splunk Cloud Platform subscription per SVC, Standard Success Plan (SE-S-CLD-SVC-ST): $10,205.10 for 0-49 SVCs and $9,354.10 at 50 SVCs and above, on the filed G-Cloud 15 price list. Premium Success Plan runs about 10 percent higher.
A balanced 50 to 100 GB/day workload typically sizes to around 20 SVCs (rule of thumb, below). At list that is a larger number than the equivalent per-GB ingest licence, which is why workload pricing only pays when search load is predictable and the SVC count is right-sized after baseline data exists.
SVC-to-GB conversion (rule of thumb)
| Workload profile | SVCs per GB/day ingest | Implied at 100 GB/day |
|---|---|---|
| Ingest-heavy, light search | 1 SVC per 5-7 GB/day | 14-20 SVCs |
| Balanced workload | 1 SVC per 3-5 GB/day | 20-34 SVCs |
| Search-heavy, ES + ITSI | 1 SVC per 1.5-3 GB/day | 34-67 SVCs |
Conversion factors are our rule of thumb, triangulated from partner enablement decks and customer-posted breakdowns over 2023-2025; they are not a Splunk figure. Splunk's own calculator is authoritative for your specific workload but requires sales engagement.
When workload pricing beats ingest pricing
- + Predictable search load against a stable corpus
- + Heavy use of accelerated data models (Enterprise Security)
- + Long-retention searches that re-scan archived data
- - Spiky or unpredictable ingest patterns
- - Compliance-only logging with minimal search activity
- - Small deployments where the SVC count cannot be right-sized
Splunk Cloud vs Splunk Enterprise: cost comparison
- + Pure OpEx, no hardware
- + Splunk operates the indexer cluster
- + Faster onboarding, 2-4 weeks typical
- - ~24-32% higher list rate per GB than the Enterprise term licence
- - Data residency limited to Splunk regions
- - Customisation more constrained
- + Lower per-GB licence list ($961.40 at 50 GB/day)
- + Full control over indexer cluster
- + Wins on unit cost above ~750 GB/day
- - Hardware: $200K-$500K capex per refresh (our estimate)
- - Splunk admin engineer required (~$160K/yr)
- - 3-6 month deployment timeline
Splunk Enterprise: vCPU and reference hardware sizing
Self-managed Splunk Enterprise uses Splunk-published reference hardware specs from help.splunk.com. Sizing drives infrastructure cost and is the single biggest variable behind self-managed TCO.
| Role / tier | vCPU | RAM | GB/day per indexer |
|---|---|---|---|
| Indexer, minimum reference | 24 vCPU | 12 GB | Up to 300 GB/day max |
| Indexer, mid-range | 48 vCPU | 64 GB | 100 GB/day recommended |
| Indexer, high-performance | 96 vCPU | 128 GB | Higher with search headroom |
| Indexer with Enterprise Security | 48-96 vCPU | 64+ GB | 60 GB/day per indexer |
| Search head | 32 vCPU | 12 GB | Sized by concurrent users |
Source: Splunk Enterprise Capacity Planning Manual, current documentation at help.splunk.com.
Sustained storage IOPS must meet or exceed 800 per Splunk's published requirement. Below that, search performance degrades under concurrent load and the indexer bottlenecks on disk rather than CPU.
Splunk compresses ingested data roughly 2-to-1 at rest. Plan storage for half the daily ingest volume, multiplied by retention days, with headroom for hot and warm bucket overlap.
Enterprise Security inflates indexer count significantly at the same ingest volume because of accelerated data model rebuilds. A 300 GB/day raw Splunk environment may run on 2-3 indexers; the same environment with ES typically needs 5 or more.
Real-world Splunk cost scenarios
| Scenario | Profile | Licence (list) | Total TCO (our model) | Notes |
|---|---|---|---|---|
| Startup | 5 GB/day, Splunk Cloud, 90-day retention | $10K list (no ES at this volume) | $30K-$50K | ES is not sold below 50 GB/day; add-ons stay off at this scale |
| Mid-market | 50 GB/day, Splunk Cloud, 365-day retention | $63K base, $124K with ES | $260K-$340K | ES adds 96% at this band; required for SOC use |
| Enterprise | 200 GB/day, Splunk Cloud, 365-day retention | $195K base, $312K with ES | $800K-$1.1M | Per-GB rate falls with volume; ES and staffing dominate TCO |
| Large enterprise | 1 TB/day, Enterprise term (self-managed), 24-month retention | $621K base term licence | $2.5M-$3.5M | Add ES, hardware and admin staff; multi-year EA discounts apply at this size |
| MSSP multi-tenant | 500 GB/day aggregate, Splunk Cloud | $426K base, $667K with ES | $1.6M-$2.2M | Per-tenant indexing complicates volume math |
Licence figures are list arithmetic on the filed per-GB ladder, before any discount. Total TCO is our estimate: licence plus infrastructure, professional services for initial deployment, storage, and one analyst FTE per 50-75 GB per day. Discounts of 25-40 percent are routine on Enterprise Agreements.
Five proven Splunk cost optimisations
Filter at the edge
Save 30-50%Drop verbose Windows event noise, debug logs, and DNS chatter at the forwarder. Most environments cut 30 percent or more without losing detection coverage.
Summary indexing
Save 10-20%Roll up high-volume sources into summary indexes for long-term searches. Detail data lives in cold storage; queries hit the summary.
Workload pricing tiers
Save 15-25%Splunk's SVC-based workload pricing rewards predictable search loads over spiky ingest. Right-sizing SVCs after baseline data exists is essential.
Archive to cold tier
Save 60-80%S3 or Glacier archive replaces hot storage for retention beyond 90 days. The compliance clock keeps ticking; the indexing bill does not.
Multi-year EA negotiation
Save 25-40%Enterprise Agreements above $500K list see 25-40 percent off in routine negotiations. Splunk's quarter-end is the right pressure point.
Splunk vs Sentinel vs QRadar at 50 GB per day
Same environment, three vendors, twelve months. List prices before any negotiated discount.
On base ingest list alone, Splunk sits in the same range as Sentinel at this volume. Its premium appears once you add Enterprise Security, which takes the Splunk licence to about $124K, and at higher volumes where the per-GB rates diverge. Sentinel is close on a commitment tier and bundles the SIEM content that Splunk sells as ES. QRadar carries no figure here because IBM publishes no list price on any channel, so the third column is a quote you have to obtain rather than a number we can source. Compare like for like: the Splunk headline here is base ingest only.