Compare / Splunk vs Datadog

Splunk vs Datadog Cloud SIEM cost: 2026 comparison

Head-to-head cost comparison. Per-GB Splunk versus per-host-plus-per-GB Datadog at five host-and-volume profiles, five-year TCO, and where each vendor wins on consolidation versus depth. Splunk baseline set to its filed 2026 list pricing. Updated October 2026.

Page updated 13 October 2026/First published 15 May 2026

Splunk model

Per-GB ingested

Plus ES separate licence

Datadog model

Per-host + per-GB

Cloud SIEM line scales with analyzed events

100h / 50GB

Splunk edges it

Splunk ~$124K vs Datadog ~$130K base

500h / 50GB

Splunk wins

Per-host base inverts at scale

Per-GB versus per-host: how the meters collide

Splunk and Datadog price on different axes, which makes the comparison structurally interesting. Splunk meters per gigabyte ingested, with a separate Enterprise Security licence covering SIEM analytics and content. Datadog meters per host (Infrastructure base) plus per-GB-ingested (Logs) plus per-million-analyzed-events (Cloud SIEM) plus per-million-events (indexing tier). The meter mismatch means the comparison flips between Splunk-favoured and Datadog-favoured depending on the host-to-log-volume ratio of the specific environment.

On Splunk's filed 2026 list pricing (about $63K ingest and about $124K with Enterprise Security at 50 GB per day), the comparison leans toward Splunk at most profiles. Datadog's structural win now rests on the consolidation case: where hosts already pay for Datadog Infrastructure or APM, the marginal Cloud SIEM cost is genuinely small (typically $3K to $18K per year on the $5-per-million-analyzed-events meter). Where Datadog is adopted fresh as a standalone SIEM, its per-host base plus Logs indexing generally lands above Splunk's base. The 500-host / low-log profile is the clearest Splunk win, where Datadog's per-host base inverts the unit economics.

Detection content depth is the second axis where Splunk maintains structural advantage. Splunk Enterprise Security plus the broader content ecosystem (premium content packs, ITSI integration, community apps, mature SOAR add-on) deliver investigation depth that Datadog Cloud SIEM does not yet match. For mature SOCs where this depth is the binding constraint, the licence cost comparison is secondary. For SOCs whose detection content is broadly portable or built de novo, the licence savings can drive the migration.

Same environment, both vendors

Profile	Splunk Cloud + ES	Datadog (infra + logs base)	Winner	Note
50 hosts, 25 GB/day	~$38K (base only)	$58K	Splunk	ES is not sold below 50 GB/day; Datadog wins only where host/APM spend is already sunk
100 hosts, 50 GB/day	$124K (with ES)	$110K-$150K base	Splunk, narrowly	Datadog's infra-plus-logs base alone brackets Splunk with ES; Cloud SIEM line is additive
200 hosts, 50 GB/day	$124K (with ES)	$155K-$200K	Splunk	Datadog per-host base overtakes Splunk at higher host counts
500 hosts, 100 GB/day	$177K (with ES)	$300K-$420K	Splunk decisive	Datadog per-host base inverts the unit-economics argument
200 hosts, 250 GB/day	$391K (with ES)	$520K-$720K	Splunk	Both priced poorly at this profile; Sentinel often preferred

Annual licence ranges, before negotiated multi-year discounts. Splunk figures follow filed 2026 list pricing ($1,265 per GB/day per year base at 50 GB/day; Enterprise Security adds about 96% at 50 GB/day and 55-75% above that, and is not sold below 50 GB/day, so the 25 GB/day row is base only). The Datadog figures are the infrastructure-plus-Logs base; Cloud SIEM is metered separately per million analyzed events ($5/million, annual) and is additive on top, so model your routed-event volume before treating a base-only win as final.

Five-year TCO at 100 hosts and 50 GB per day

Year	Splunk Cloud + ES	Datadog
Year 1 (100 hosts, 50 GB/day)	$124K (with ES)	$135K (full stack)
Year 2	$109K (TCO drop)	$130K (steady state)
Year 3	$105K (steady state)	$130K
Year 4	$111K (5% inflation)	$136K (5% inflation)
Year 5	$116K	$143K
5-year total	$565K	$674K

Five-year cumulative includes initial licence, 5% inflation per year, and Year 2 TCO compression on Splunk. Datadog is shown as fresh full-stack adoption; where Datadog Infrastructure or APM is already deployed, the marginal Cloud SIEM line is small and can flip the comparison. Excludes one-time migration costs.

When Splunk genuinely wins

+Mature SOCs with deep custom Splunk ES content where the depth and search performance are the binding constraint, not consolidation
+Environments with high-host / low-log-volume ratios where Datadog's per-host base inverts the unit-economics argument
+Detection content libraries (premium content packs, ITSI, SOAR) that Datadog Cloud SIEM does not match
+Compliance-driven retention where Splunk Cloud's archive tier with searchable cold storage beats Datadog Flex Logs query latency
+Existing Splunk-trained SOC analysts where retraining on Datadog SIEM workflow delivers productivity tax that licence saving cannot recover

When Datadog genuinely wins

+Existing Datadog APM and Infrastructure customers where the marginal Cloud SIEM line is genuinely small (typically $3K-$18K per year)
+Engineering-led security teams who value API-first detection workflow and code-driven detection management
+Cloud-native environments where application telemetry (Datadog APM, traces, RUM) is the primary detection input, not network and endpoint correlation
+Organisations consolidating monitoring and security on a single platform where the operational simplification of one vendor matters
+Cost-driven Splunk migrations at moderate scale where Datadog Flex Logs absorbs long-retention compliance volume cheaply

FAQ

Common questions

Is Splunk or Datadog Cloud SIEM cheaper at 100 hosts and 50 GB per day?

On Splunk's filed 2026 list pricing this leans narrowly toward Splunk for fresh adoption. Splunk Cloud at 50 GB per day plus Enterprise Security lists at about $124K per year (about $63K base ingest plus about $61K for Enterprise Security). Datadog at 100 hosts and 50 GB per day runs an estimated $110K to $150K base, covering the per-host Infrastructure base (about $18K) and indexed log retention ($95K-$130K), with the Cloud SIEM line metered separately at $5 per million analyzed events on top. So a fresh Datadog SIEM deployment, once the Cloud SIEM line is added, generally lands at or above Splunk. Datadog wins where the per-host base is already absorbed by existing Datadog Infrastructure or APM spend, leaving only a small marginal Cloud SIEM line. Model the analyzed-event line before declaring a winner either way.

How is Datadog Cloud SIEM priced relative to the rest of the Datadog bill?

Datadog prices Cloud SIEM as an add-on layered on top of Datadog Logs, metered per million analyzed events ($5 per million, annual billing) rather than a flat per-GB rate, so its cost tracks your analyzed-event volume. The rest of the Datadog bill is dominated by the underlying Logs spend (per-GB ingest plus per-million-event indexing) and the Infrastructure host count, both of which Cloud SIEM customers pay regardless. Single-line Cloud SIEM rate comparisons against Splunk understate Datadog's true bill; only the all-in math, including the analyzed-event line modeled on your own routed-event volume, matters for buying decisions.

When does Splunk genuinely beat Datadog?

Splunk wins decisively in environments with high host counts and modest log volumes (e.g., 500 hosts at 50 GB per day), where Datadog's per-host base inverts the unit economics. A 500-host environment pays roughly $90K to $110K for Datadog Infrastructure before any logs at all, while Splunk at 50 GB per day lists at about $124K with Enterprise Security, logs included. On Splunk's filed 2026 list pricing, Splunk is competitive-to-cheaper across most fresh-adoption profiles, not just the high-host case. Splunk also wins for mature SOCs with deep ES content libraries built over years, where migration cost outweighs licence saving for 24-36 months, and where investigation depth (ES, premium content, SOAR) is the binding constraint rather than raw log volume cost.

What is the migration cost from Splunk to Datadog?

Migration cost varies materially with detection content depth and analyst retraining. A typical mid-market migration (50 GB per day, 200 detections, 8-person SOC) runs $120K-$250K in professional services plus 4-8 months calendar time. Migration of Splunk SPL queries to Datadog query syntax is the largest single workstream. For organisations where the licence saving is $50K-$100K per year, the payback is 2-3 years. For organisations where the licence saving is $200K-plus per year, the payback drops under 18 months and migration is straightforwardly the right call. The decision should also weigh detection content portability (SIGMA-aligned content migrates faster than Splunk-native ES content) and SOC retraining capacity.

Does Datadog Cloud SIEM include UEBA and SOAR?

Datadog Cloud SIEM includes basic UEBA (entity timeline, behavioural baselines) but at moderate depth comparable to Splunk Enterprise Security with a basic UEBA app, not matching Exabeam or Securonix specialist depth. SOAR is delivered through Datadog Workflows and external integrations (Tines, Torq, etc.) rather than bundled in Cloud SIEM directly. Splunk's SOAR is a separately-licensed product. For organisations whose UEBA needs are basic-to-moderate and whose SOAR needs are delivered through external automation platforms, Datadog Cloud SIEM is structurally sufficient. For organisations needing deep bundled UEBA or SOAR within the SIEM platform, Splunk plus its add-ons typically wins.