Splunk vs Elastic

Where Elastic wins

You can build the budget yourself

Elastic's serverless security price sheet, effective 1 November 2025, gives you numbers to multiply: Security Analytics Essentials from $0.09 per GB ingested and $0.017 per GB month retained, Complete at $0.11 and $0.019, with 50 GB of egress free and $0.05 per GB after that. Add-ons are priced the same way, from $0.65 per billable asset per month for cloud posture to $0.41 or $0.49 per asset for workload protection. Splunk's pricing page, by contrast, names Workload, Ingest and Entity pricing and shows no figure at all, and the AWS Marketplace listing for Splunk Cloud states plainly that pricing depends on your requirements and eligibility and that you should request a private offer. For anyone who has to defend a number to finance before they are allowed to run a proof of concept, that difference decides the evaluation.

The licence gives you an exit

Elastic added AGPL-3.0 as a licence option for the Elasticsearch and Kibana source code on 29 August 2024, making the free part of the codebase OSI open source again, with client libraries still Apache-2.0. That matters less as ideology than as leverage: the cluster you build can keep running on your own hardware if the commercial relationship goes wrong. Splunk has no equivalent, and its own Free licence is not a fallback, as the next section explains.

Rule migration is no longer entirely manual

Elastic Security 8.18 and 9.0, released in April 2025, introduced Automatic Migration: an AI-driven workflow that translates Splunk SPL detection rules into ES|QL, maps some of them onto prebuilt detections maintained by Elastic Security Labs, and carries across associated lookups and macros. It validates the generated query syntax deterministically and loops to revise when validation fails. Elastic also runs an Express Migration programme aimed specifically at Splunk customers. Elastic's own claims about how much of a rule set converts cleanly are vendor marketing, so treat the percentages as vendor claims and test on your ugliest twenty rules first, not your cleanest ten. Even discounted, the tooling turns the largest line item in a Splunk migration from a rewrite into a review.

One stack instead of two products

Because Elastic Security runs on the same indices as your logs, the SIEM and the log platform are one cluster with one retention policy. On Splunk, Enterprise Security is a premium app licensed on top of the platform, so the security team's requirements and the observability team's requirements arrive as separate line items on the same renewal.

Where Splunk still wins

SPL is the thing Elastic has not rebuilt. Twenty years of Splunk means a query language that expresses transformations ES|QL still cannot, a content library in Enterprise Security that includes risk-based alerting and mature notable-event workflow, and Splunkbase add-ons that parse mainframe, storage and appliance formats where an Elastic integration simply does not exist. If your detection engineers are fluent in SPL and your value lives in the searches they wrote, moving is a rewrite of the asset rather than a change of vendor, and the tooling above shortens that job without eliminating it.

The pricing model can also come out ahead, and for a specific reason. Because Splunk quotes rather than publishes, the price is negotiable, and a large estate with credible alternatives on the table frequently lands below what a published per-GB rate would have charged for the same volume. Elastic's $0.09 per GB is a ceiling you cannot argue with on serverless, while Splunk's silence is an invitation to argue. Add Cisco Enterprise Agreement bundling since the acquisition closed on 18 March 2024, and for organisations that already buy Cisco networking at scale, Splunk can arrive attached to paper that is already signed.

Migrating Splunk to Elastic

The path most teams take:

1. Inventory first. Export the saved searches, dashboards, correlation searches and lookups you actually use, not everything that exists. Note which Splunkbase add-ons do the parsing, because those are the items with no Elastic equivalent and the ones that generate surprise work.
2. Move ingestion before rules. Point Elastic Agent or an OpenTelemetry collector at the same sources so the data lands in both platforms, then run Automatic Migration on the detection rules; the tool can also work the other way and tell you which sources a migrated rule needs.
3. Run both for one full detection cycle. At least one month, ideally through a real incident, comparing alert-for-alert. Budget for the overlap: you are paying Splunk and Elastic simultaneously, and skipping this step is how teams discover a silently broken detection in production.
4. What does not move. Historical indexed data stays in Splunk unless you re-ingest it, which usually means paying Elastic ingest cost for data you already paid Splunk to index. Most teams keep a small read-only Splunk licence for the retention window instead, then let it lapse. Dashboards need rebuilding by hand, and the muscle memory of every analyst who thinks in SPL is a real cost that no migration tool addresses.