Splunk SIEM Pricing in 2026: Full Cost Breakdown (and How to Cut It) 

Splunk charges in one of three ways: by how much data you send it each day, by how much compute your searches and dashboards use, or, on Splunk Cloud Platform, by activity. Security teams pay for both the platform and Splunk Enterprise Security, the app that turns Splunk into a SIEM, which is licensed separately on top.

This guide breaks down every part of a 2026 Splunk bill, works through a pricing example, explains what counts against your license, and lays out the ways to bring the number down.

Prefer to jump straight to the numbers? See the full 2026 cost breakdown.

Looking at SIEM pricing across providers? See the SIEM pricing guide and the Microsoft Sentinel, Google SecOps and Elastic breakdowns.

Splunk sells the platform and Enterprise Security on the same pricing models. Ingest pricing charges per gigabyte indexed per day. Workload pricing charges for compute: Splunk Virtual Compute units (SVCs) on Splunk Cloud Platform and vCPUs on Splunk Enterprise. Activity-based pricing, available on Splunk Cloud Platform only, draws down a committed balance as you ingest and search.

Sources: Splunk pricing models, Splunk pricing FAQ, Types of Splunk Enterprise licenses.

For a security team, the bill is the platform license plus Enterprise Security, both on the same metric. Ingest pricing gives predictable cost when your data volume is stable. Workload pricing can cost less when search activity is light relative to the volume you ingest, and more when your team runs heavy, constant search and correlation against that data. Which option is cheaper depends on your usage pattern.

Free, trial and developer licenses exist as well. None of them is meant for production security monitoring; the FAQ below covers their limits.

Splunk does not publish list prices for Splunk Enterprise, Splunk Cloud Platform or Enterprise Security. It quotes them, with built-in volume discounts. Public list prices for a 12-month Splunk Enterprise term license run from $2,277 per GB/day at 1 GB/day down to $575 at 5,000 GB/day and above.

List price per GB/day for a 12-month Splunk Enterprise term license with Standard Success Plan. These prices cover the platform license; Enterprise Security is licensed on top.

Contract data points the same way. Buyer data from 211 Splunk purchases shows a median contract value of $84,861, with buyers saving 12% on average.

An illustrative example: at 200 GB/day, the listed tier of $733.70 per GB/day comes to $146,740 a year for the platform license. Negotiated discounts bring that figure down. Enterprise Security comes on top of it, on the same ingest or workload metric.

Workload pricing has no public reference point. Splunk publishes no per-SVC price, and the number of SVCs a workload needs is estimated at quote time. Get a quote for your own search and ingest pattern before you budget against any published estimate.

The license covered above is the core of a Splunk SIEM bill. Four other components complete it.

Splunk Enterprise Security is a premium app licensed on top of the base platform, on ingest or workload pricing. It comes in two editions, Essentials and Premier. User and entity behavior analytics (UEBA) is part of Premier only. Splunk does not publish Enterprise Security prices, so budget it from a quote.

Storage and retention depend on the model. On Splunk Cloud Platform ingest pricing, the subscription includes storage for 90 days of indexed data, and longer retention is purchased separately. Workload pricing on Splunk Cloud Platform adds storage as blocks sized to your retention policy. Self-hosted Splunk Enterprise moves storage into your own infrastructure, across hot, warm, cold and frozen tiers, each with its own performance and cost.

Infrastructure and admin overhead apply to self-hosted Splunk Enterprise. Compute, storage hardware, and the staff time for upgrades, patching and capacity planning are real costs that a Splunk Cloud Platform subscription absorbs into its price.

Premium apps such as Splunk SOAR and IT Service Intelligence are licensed separately from both the platform and Enterprise Security. Standalone Splunk User Behavior Analytics has been off sale since 12 December 2025, with end of support on 31 January 2027. Its successor, UEBA, sits inside Enterprise Security Premier.

Splunk meters the raw data that enters the indexing pipeline, measured each day from midnight to midnight on the license manager’s clock. Data that is filtered and dropped before indexing does not count against the license. For a SIEM, these rules meter every security source Enterprise Security runs on.

The rest of the rules, from Splunk’s licensing documentation:

Going over the licensed volume has its own rules. Each calendar day above your limit generates a warning. On Splunk Enterprise license stacks under 100 GB/day, 45 warnings in a rolling 60-day period put you in violation: Splunk keeps indexing, search is blocked, and a reset license comes from Splunk Sales. Stacks of 100 GB/day or more receive warnings only, and infrastructure (vCPU) licenses do not enforce violations. On Splunk Cloud Platform, ingest subscriptions can exceed the purchased daily volume up to five times in a calendar month.

The meter runs at the indexing pipeline, and that sets the cost logic. Compression, tiered storage and shorter retention change what you store afterwards. What was indexed has already been billed. So the volume that reaches the index is the lever: every gigabyte removed before Splunk is a gigabyte the license never counts. DataStream for Splunk works at that point, alongside Splunk’s own Ingest Actions and pre-ingest CIM normalization for Splunk.

A few standard levers help on any pricing model.

Match your pricing model to your actual usage pattern, and revisit that choice at renewal as usage shifts.

Move known high-volume, low-value log types, such as verbose endpoint logs, routine firewall traffic and debug output, to cheaper storage tiers. Set retention to what compliance requires.

Pay close attention to high-volume sources with little detection value. Firewalls, DNS and endpoint logs are the usual candidates.

Each of these helps reduce SIEM costs. They act on data that has already reached Splunk and already been billed. The lever that acts on the meter itself is to filter and reduce data before ingestion: drop known-noisy events, trim redundant fields, deduplicate repeated telemetry, and forward what detections use.

Splunk has a native option for this step. Ingest Actions filters, masks and routes data before indexing, and it is free with Splunk Cloud Platform and Splunk Enterprise. It works per source type inside Splunk.

VirtualMetric DataStream handles the same step across all your sources. It is a security data pipeline in front of Splunk that filters, normalizes and routes data before it reaches the index.

VirtualMetric DataStream is a security data pipeline that sits between your log sources and Splunk. It collects telemetry, normalizes it, enriches it with context, filters it, and routes it to the right destination, so Splunk indexes the data your detections need.

Its capabilities map onto the cost problem above:

Two more points matter for a Splunk SIEM. Full raw logs stay available in low-cost storage for forensic retrieval, so a smaller Splunk bill keeps the investigation trail complete. And DataStream works with the SIEM you run next: the same pipeline can route to another SIEM later, without rebuilding collection.

You can calculate your savings with ingestion figures from your own environment. For Splunk specifically, see how VirtualMetric for Splunk fits into an existing deployment.

Splunk quotes its prices instead of publishing them. Public list prices for a 12-month Splunk Enterprise term license run from $2,277 per GB/day at 1 GB/day to $575 at 5,000 GB/day and above; at 200 GB/day that is $146,740 a year before discounts. Buyer data from 211 purchases shows a median Splunk contract value of $84,861. Enterprise Security is licensed on top of the platform.

No. Splunk measures license usage at the indexing pipeline, so data filtered and dropped before indexing does not count. Data that is indexed counts, including copies that are also routed elsewhere. Reducing data before it reaches Splunk therefore lowers license usage directly.

Yes. Enterprise Security is a premium app licensed on top of the base Splunk platform, on ingest or workload pricing, and it is not part of standard platform pricing. It comes in two editions, Essentials and Premier, and UEBA is included in Premier only. Splunk does not publish Enterprise Security prices.

Yes, with limits. The Splunk Free license indexes up to 500 MB per day with a reduced feature set, and the Splunk Enterprise Trial license also allows 500 MB per day. The Developer license allows 10 GB per day for six months. None of them is meant for production security monitoring.

Reduce data before it reaches Splunk, since the license meter counts what enters the indexing pipeline. Splunk’s Ingest Actions handles basic filtering per source type, and a security data pipeline such as VirtualMetric DataStream filters, normalizes and routes data across all sources before ingestion. With DataStream, typical Splunk deployments cut daily ingest volume by 40 to 60 percent.