Splunk Pricing Explained: SVCs, Ingest, Storage and Quotes

How to cut the bill

1. Filter before you ingest. Drop fields and events you never search. NIST's log management guide, SP 800-92, asks you to set a purpose and retention for each log source before you collect it.
2. Match the model to your search pattern. Workload pricing favours large volumes searched rarely; ingest pricing favours heavy search over a steady volume.
3. Stay under the overage limit. On ingest pricing, more than five days over your daily volume in a month is a breach of terms, not just a spike.
4. Tier retention by use. Keep searchable storage for the investigation window; archive the rest. Remember the 24-hour restore when you set the window.
5. Claim the Cisco weighting for eligible Cisco sources.
6. Retire detections that never fire. Every scheduled search consumes compute. Researchers who re-engineered SIEM correlation rules found higher detection rates and fewer false positives, and traced much of SIEM's shortfall to insufficient configuration (Bryant and Saiedian, Computers & Security, 2020).

For levers that apply to any SIEM, see our SIEM price reduction tactics, and for costs outside the licence line, the hidden costs of SIEM.

Why not archive most of your data?

It is the obvious way to cut searchable storage, and the same trade-off appears in Microsoft Sentinel's data lake. Archived data cannot be searched until it is restored, and restored data is searchable for up to 30 days. The sources that go to archive first are the high-volume ones: firewall, DNS, proxy and network flow logs. MITRE ATT&CK notes that for command and control, "adversaries commonly attempt to mimic normal, expected traffic to avoid detection". Our judgement: archiving network logs to save money saves it on the records you need to spot that traffic, and a hunt that reaches back months starts with a wait.

Where SenseOn fits

SenseOn is priced differently, and there is no restore step. It is priced as an annual pool of Flex Intelligence Credits. You pay for outcomes: detection and response across your data, analytics included, and the investigations its AI completes. Data volume is one meter, not the whole bill. Three things bring the cost down:

• Edge processing removes unnecessary data before it reaches the pipeline.
• Three-pipeline routing, configured by Weave, SenseOn's security engineering agent, sends each source down the right pipeline, with storage separated from compute.
• Compression, with storage priced on the compressed volume.

Together these cut costs by about 40% against a traditional SIEM. The price also covers the Agentic Cybersecurity Team (ACT), SenseOn's AI agents that investigate and resolve cases. You pay for the investigations the agents complete, not for an MDR service.

Detection is set per log source, not by storage tier. SenseOn detects in real time on the endpoint, in near real time across every log source you route to Detection & Response, as it streams through its message queue, and with behavioural analytics that run about every five minutes across those same sources. Data rolls between tiers automatically and can be routed straight into any tier. SenseOn's AI agents run queries and threat hunts across every tier for the whole retention period. Because they are long-running agents, a query over older data can take a little longer without anyone waiting on it.

SenseOn deploys alongside Splunk, so you can run both for a 14 to 28 day proof window and compare on your own data. See our Sentinel vs Splunk vs SenseOn comparison, SenseOn vs Splunk and Splunk alternatives, or the pricing page for SenseOn's credit plans.

Sources

• Splunk pricing models, accessed 23 September 2026
• Platform pricing, accessed 23 September 2026
• Platform pricing FAQ, accessed 23 September 2026
• Pricing calculator, accessed 23 September 2026
• Splunk Cloud Platform service details, updated 6 March 2026, accessed 23 September 2026
• Store expired Splunk Cloud Platform data in a Splunk-managed archive, accessed 23 September 2026
• About Federated Search for Amazon S3, updated 6 March 2026, accessed 23 September 2026
• About Splunk Free, updated 13 January 2026, accessed 23 September 2026
• Splunk Enterprise Security, accessed 23 September 2026
• Blake D. Bryant, Hossein Saiedian, "Improving SIEM alert metadata aggregation with a novel kill-chain based classification model", Computers & Security, 2020, https://doi.org/10.1016/j.cose.2020.101817
• NIST, SP 800-92: Guide to Computer Security Log Management, September 2006, accessed 23 September 2026
• MITRE, ATT&CK Command and Control, TA0011, accessed 23 September 2026

How SenseOn writes, checks and corrects its content: editorial standards.

Frequently asked questions

How much does Splunk cost?

Splunk does not publish a price for Splunk Cloud Platform or Splunk Enterprise Security; every deal is quoted. The quote is sized in Splunk Virtual Compute units (SVCs) on workload pricing, in gigabytes a day on ingest pricing, or on both ingest and search activity on activity-based pricing. Splunk's own pricing calculator estimates SVCs from your daily data volume, not dollars.

What is an SVC in Splunk?

A Splunk Virtual Compute unit. Splunk defines it as "a unit of capabilities in Splunk Cloud Platform that includes compute, memory, and I/O resources". Workload subscriptions are sized in SVCs and do not meter ingestion; ingest subscriptions come with up to 1 SVC for every 10 GB a day.

Is Splunk priced per GB?

It can be. Ingest pricing is "based on gigabytes of data ingested into Splunk". But Splunk's Cloud Platform service details say subscriptions are workload-based by default and ingest-based only by exception. On an ingest subscription you can exceed your purchased daily volume a maximum of five times in a calendar month.

How long does it take to restore archived Splunk data?

Splunk's archive documentation says "the restoration process can take up to 24 hours to complete", and the Cloud Platform service details say restored data is searchable for up to 30 days. Splunk may block restores of large amounts of data that could affect performance.

Is there a free version of Splunk?

Splunk Free lets you index 500 MB a day on a single Splunk Enterprise instance. It has no alerting, no users or roles, and search is disabled after repeated licence violations, so it is for learning rather than security operations. Splunk also offers free trials of Splunk Cloud and Splunk Enterprise.