In my more than five years at Splunk, one topic that has consistently come up with customers is pricing. Customers often have fair questions about how our pricing works, how they can better project their license cost, and what happens if they go over. Not knowing the answers to these questions can leave customers worried that Splunk is expensive or that it is too hard to control how much they will spend.
While the answers certainly exist, they’re not always easy to find. And that’s on us—we could do a much better job letting folks know what pricing programs we have in place (c’mon, Marketing guy!). So in that spirit, here are a few answers to the most common pricing questions that you might have.
How does Splunk’s pricing model work?
Splunk Enterprise software pricing is based on the amount of data indexed by your Splunk instance on a daily basis, calculated in GB per day. You can buy any index volume from 1 GB/day to multiple terabytes of data per day. Splunk Enterprise pricing has built-in volume discounts. For example, the unit price per GB decreases by 67% as total daily index volume grows from 1GB/day to 100 GB/day.
If you’re just getting started with Splunk and want to do some initial sizing, check out this interactive pricing tool for Splunk Enterprise that will give you list prices for both Annual- and Perpetual-License types. If you’re looking for Splunk Cloud pricing, you’ll find it there too.
How can I think about growing my Splunk usage relative to pricing?
Most customers start with a specific use case—like infrastructure monitoring or security investigation—then expand over time as more teams and groups see firsthand the value Splunk delivers. But how do you manage if you only have budget for that initial use case? How can you experiment and kick the tires on other use cases?
Once again, more good news!
- If you’re just getting started, we have Quick Start Bundles to get you up and running with everything you need to use Splunk to solve a specific problem at a compelling price: license, support, recommended apps, pre-packaged professional services, education credits, even a .conf pass.
- When you’re ready to expand beyond that initial use case, we offer simple capacity upgrades with built-in volume discounts. And remember, you only pay once at time of ingest. Once your data is in Splunk, you can perform unlimited searches on that data to solve additional business problems.
How can I predict how much I’ll need to spend on a license?
If you don’t have a clear idea of how much data you need to get into Splunk, our Sales Engineers and Business Value Consulting teams can help you work through sizing. Or maybe you just want to start tackling use cases and getting the answers needed by your team.
We have four great options for both new and existing customers:
- For new customers, we offer a free Splunk Enterprise download up to 500 MB/day intended for individual use, including access to data onboarding, universal indexing, search, reporting, knowledge mapping, dashboards, the Splunk Machine Learning Toolkit, access to hundreds of Splunk apps, the Splunk Universal Forwarder, a rich developer environment, and standard support.
- We also offer new customers a free Splunk Cloud trial that lets you search, analyze, and visualize your own data, or just play around with our pre-populated data sets. Your free Cloud trial lets you search, analyze and visualize up to 5GB of your own data for 15 days. If you like what you see, it's simple to transition your trial to a paid production account.
- When you download Splunk Enterprise Free (for Docker), you get a 1-year license that lets you index up to 20 GB of data per day, enabling you to unify insights across container environments and the entire technology stack.
- For existing customers that want to test out new use cases without worrying about their production license capacity, any individual user in an organization that has purchased Splunk Enterprise or Splunk Cloud can request a personalized Dev/Test license to experiment with Splunk at no cost (as long as your support contract is current). With a Dev/Test license, you will receive a six-month 50 GB/day term license that will be individualized to your corporate email address. You can find more details here: splunk.com/dev-test.
What happens if usage exceeds my purchased license capacity (alt. “What if I blow past my license”)?
You know the way to get the most value out of your data is to get that data into Splunk. You also know that organic growth in data sources and volumes, or an occasional unplanned data spike, can cause your daily ingestion to exceed your current license capacity.
It’s an embarrassment of riches in the good news department:
- We recognize that license overages sometimes happen, which is why we allow for five overages in a rolling 30-day period before you would be considered out of compliance with the terms of your license.
- If you think your data usage will be sustained, it may be time to upgrade. We can help with a data source assessment (email firstname.lastname@example.org to learn more) to evaluate your current and future data needs and determine the right size for your upgrade license purchase.
- What if you just want to play around with a new data source or use case without consuming your production license? Here again, personalized Dev/Test licenses give you that flexibility.
- For larger customers that want predictable costs that align with their budget cycle, we offer a term license True-Up Program starting at 500GB/day. This program allows you to grow your usage over time, and pay an annual true-up for any sustained usage over your purchased license capacity. For more information, check out the True-Up Program Guide.
- Finally, if you want the flexibility to go all-in with Splunk and not have to track your daily ingestion, we offer Unlimited Enterprise Adoption Agreements (EAAs) with “all you can eat” licensing to take the anxiety of overages completely off the table.
Hopefully this helps clarify how you can grow with Splunk with a licensing model that grows with you. For more information, check out the Splunk Pricing Page; if you have any other questions drop a line to email@example.com and we’ll help you out.