Splunk vs Graylog

Where Graylog wins

Splunk Free is a lab licence, and the docs say so

Read Splunk's own licence page rather than the marketing page. Splunk Free indexes 500 MB per day, and beyond the volume it removes the things that make a log platform operational. There is no authentication at all, so there are no users and no roles. Alerting, which Splunk's documentation calls monitoring, is not available. There is no distributed search, no search head clustering and no indexer clustering. There is no TCP or HTTP forwarding of data to other Splunk instances, no deployment management for forwarders, and no report acceleration. Exceed the volume three times in a rolling 30-day window and you lose the ability to search until the warnings clear. It is a licence for learning SPL on a laptop, not a tier you can quietly build on.

Graylog Open has no meter at all

Graylog states it directly on its source-available product page: no per-user fees, no ingestion caps, and no time-limited trial. Open includes dashboards, full REST API access, and both threshold and event-based alerts. That combination is the whole argument. A team with 40 GB a day of application logs and no budget has a working platform on Graylog Open and has nothing on Splunk Free.

The workflow feels familiar

Of the free options, Graylog is the one shaped most like Splunk. Streams route incoming messages the way indexes and event types do, pipelines and extractors do the parsing work of props and transforms, and saved searches and dashboards sit where you expect them. Teams moving to a raw search engine have to learn a new mental model as well as a new query language; here mostly the query syntax changes.

Paid tiers exist without hiding the free one

What Graylog holds back for paid editions is legible: data lake and parallel archive restore, Azure Blob support, compliance packs for GDPR and HIPAA, formal audit reporting, and the security content, meaning correlation rules, behavioural analytics and prebuilt detections. Those are genuine enterprise requirements rather than artificial crippling of the free build, which is the difference between a free tier and a demo.

Where Splunk still wins

Detection content is the honest gap. Splunk Enterprise Security ships correlation searches, risk-based alerting and a mature notable-event workflow that a security team can use on day one. On the free Graylog path you write your detections yourself, and the prebuilt equivalents sit in paid Graylog Security. If your Splunk deployment exists because a SOC needs it, compare Splunk against Microsoft Sentinel or Splunk against Elastic before you compare it here.

Then there is the operations bill that no licence shows. Graylog free means you own the OpenSearch or Elasticsearch cluster underneath it: sizing, shard counts, index rotation, retention, upgrades, and the pager when an indexer fills its disk. Splunk Cloud is Splunk's problem. Splunkbase also matters more than people expect; the long tail of mainframe, storage and appliance formats has a Splunk add-on and frequently no Graylog equivalent, so somebody writes the parser. And a licence check worth running early: Graylog Open is SSPL v1, which is not OSI-approved, so it is source available rather than open source. If an OSI licence is a hard requirement, OpenSearch under Apache 2.0 or Grafana Loki under AGPL-3.0 are the honest answers instead.

Migrating Splunk to Graylog

The path most teams take:

1. Size the cluster before anything else. Take your real daily volume and retention requirement and design the OpenSearch layer for it. This step, not the migration, is what decides whether the project succeeds.
2. Send data to both. Point syslog, Beats or your existing forwarders at Graylog alongside Splunk, then build streams and pipelines until the parsed fields match what your Splunk searches assume.
3. Rebuild searches and alerts by hand. There is no SPL translator here, unlike the tooling Elastic and Sentinel ship. Port the searches people actually run, which is usually a small fraction of what exists, and recreate their alerts as threshold or event-based rules.
4. Decide the security question explicitly. If you need prebuilt detections, price Graylog Security rather than assuming the free edition covers it, and compare that quote against what you were paying Splunk before you call the migration a saving.