On this page
Short answer
Short answer
Stay on Splunk and cut ingest when most of the cost is volume nobody searches, because filtering at the forwarding tier changes the bill without touching a single search; see Splunk ingest volume and licensing cost reduction. Move to OpenSearch or Elastic when you want a search-engine log store with ingest pipelines, dashboards and alerting you run yourself; OpenSearch is Apache 2.0, and Elasticsearch's source is available under AGPLv3, SSPL 1.0 or ELv2 at the user's choice. Choose Grafana Loki when logs are for troubleshooting next to metrics and you can live without full-text indexing. Choose ClickHouse when you want SQL over very large log volumes. Choose Datadog logs when you want a managed SaaS and accept usage-based billing. The deciding work is not the store. It is how many saved searches, alerts and detections you have, because there is no one-to-one conversion for Splunk's search language.
Splunk and six ways to replace or reduce it (checked 4 November 2026 against vendor and project pages; licences are quoted, no ingest prices are given because Splunk publishes none; the last two rows describe AceMQ's own services)
| Splunk (baseline) | Splunk, smaller ingest | OpenSearch | Elastic (ELK) | Grafana Loki | ClickHouse | Datadog logs | |
|---|---|---|---|---|---|---|---|
| What it is | Cisco-owned platform for search, monitoring and security over machine data: Splunk Enterprise, Splunk Cloud Platform, Enterprise Security, ITSI and Observability Cloud. | The same platform with less data sent to it: filtering at the forwarding tier, routing low-value data to cheap storage, per-source budgets. | Search and analytics engine with OpenSearch Dashboards, ingest pipelines and alerting, run by you or a managed provider. | Elasticsearch, Kibana, Logstash and Beats, from Elastic or run by you. | A log store from Grafana Labs that indexes labels, not full text, and keeps chunks in object storage. | A column-oriented SQL database widely used as a log and event store. | A SaaS observability platform with log management, metrics, traces and security products. |
| Licence | Commercial. Splunk Cloud Platform: activity-based, ingest or workload pricing. Splunk Enterprise: data-ingest or workload pricing. Both by quote. | As baseline. The change is volume, not terms. | Apache 2.0, under the OpenSearch Software Foundation (Linux Foundation, announced 16 September 2024). | Source under AGPLv3, SSPL 1.0 or ELv2 at the user's choice. The default distribution stays under ELv2. | AGPL-3.0-only, with some Apache 2.0 exceptions. | Apache 2.0. | Proprietary SaaS. Usage-based billing; read Datadog's pricing page. |
| Query language | SPL, with search-time field extraction, lookups and data models. | SPL. Nothing to rewrite. | DSL queries, SQL and Piped Processing Language (PPL), plus Lucene syntax in Dashboards. | Query DSL, Lucene/KQL in Kibana and ES|QL. | LogQL, built around label selectors and line filters. | SQL. | Datadog's log query syntax and facets. |
| Retention and tiers | Hot, warm, cold and frozen buckets, with remote storage options. Retention is an index setting you already manage. | Same, plus a cheaper path for data you keep but rarely search. | Index lifecycle policies and snapshots to object storage. | Index lifecycle management with data tiers and snapshots. | Object storage is the main store; retention is a compactor setting. | TTL rules and tiered storage by table. | Retention set by plan and indexing choices in Datadog. |
| Detection and content parity | Enterprise Security and ITSI content, correlation searches, notable events and apps you may rely on. | Unchanged, provided filtering does not remove a field a detection reads. | Security Analytics plugin with its own detection rules; Splunk correlation searches are rewritten. | Elastic Security with prebuilt detection rules; Splunk correlation searches are rewritten. | Alert rules through Grafana alerting. No SIEM content. | No detection content; you build it in SQL or pair it with a SIEM. | Cloud SIEM and detection rules sold as separate products. |
| Effort to migrate from Splunk | None. | Low to moderate: requires a map of what every detection and report reads. | High for estates heavy in saved searches and apps: collection, parsing, every search and alert, every dashboard. | High, with the same shape as OpenSearch. | Moderate to high: logs only, so metrics, security content and many searches need a different home. | High: data model, ingestion and every query are new work. | Moderate for collection; high for content that does not map to Datadog features. |
| AceMQ's role | Support and consulting for Splunk estates: ingest, indexers, forwarders, search performance. Independent of Splunk. | Consulting to attribute ingest by source, map detections to data and set per-source budgets. | Support and operation of OpenSearch at Tiers 1 to 4; assessment of a Splunk estate and migration planning. | Support and operation of the ELK stack at Tiers 1 to 4; assessment and migration planning. | Support for Grafana stacks; assessment and migration planning from Splunk. | Support for ClickHouse at Tiers 1 to 4; migration planning from Splunk. | Datadog assessment and cost review. AceMQ is independent of Datadog. |
| Wins when | Enterprise Security, ITSI and Splunk apps carry your security operations and the contract is not the problem. | The volume is the problem and searches are fine. | You want an Apache-licensed log and search store you control. | You want a mature log store with Kibana and Elastic Security content. | Logs mainly support troubleshooting next to Prometheus and Grafana. | You want SQL over very large volumes and your team is comfortable writing it. | You want to stop operating the platform and accept usage billing. |
Start by asking whether the problem is volume or platform
Splunk bills on what you send it. Splunk's platform pricing page (checked 4 November 2026) says Splunk Cloud Platform comes in activity-based, ingest or workload pricing, and Splunk Enterprise in data-ingest or workload pricing, with no prices listed and a "Get a quote" route. Observability Cloud is priced differently, per host. That is why "Splunk license cost" is a volume question first.
In most estates a handful of sources produce most of the volume: verbose web access logs, debug logging left on after an incident, and the same file forwarded by two agents. Attributing ingest by source, sourcetype and host and mapping each detection and report to the data it reads shows how much can be dropped or rerouted without a platform change. If that removes the pain, you have saved a migration. If it does not, the same attribution becomes the sizing sheet for any replacement, because it tells you how many gigabytes each new store must take.
What changes at Cisco, and the support dates to check
Cisco completed its acquisition of Splunk on 18 March 2024 (Cisco's acquisition page). Ownership is not a reason to leave on its own. The reasons that stand up are cost and control. One date reason is worth checking now: Splunk's software support policy gives each minor version of Splunk Enterprise 24 months from its release. By its table, 9.3 reached end of support on 24 July 2026, 9.4 does so on 16 December 2026 and 10.0 on 28 July 2027. The page says "End of Support", so we use that term, not "end of life". If you run 9.3 or 9.4, you face an upgrade decision before any platform decision, and an upgrade is a smaller project than a replacement.
The licence lines for each replacement
Licences decide what you can modify and offer to others, so the exact wording matters. OpenSearch is Apache 2.0 on its GitHub repository, and the Linux Foundation announced the OpenSearch Software Foundation on 16 September 2024 to govern it, so it is not owned by a single vendor. Elasticsearch's source is available under AGPLv3, SSPL 1.0 and ELv2 at the user's choice, per its LICENSE.txt; Elastic announced the AGPL option on 29 August 2024 as an added choice rather than a replacement, and the default distribution stays ELv2. Grafana Loki is AGPL-3.0-only with some Apache 2.0 exceptions. ClickHouse is Apache 2.0. Datadog is a proprietary service. None of this is legal advice, and AceMQ gives no vendor licensing advice; have counsel read any licence you build a product on.
For the two search engines side by side, see OpenSearch vs Elasticsearch.
SPL, saved searches and detections: the real cost of leaving
The storage is the easy half of a Splunk migration. The hard half is everything written in SPL and the apps around it. Count these before you choose anything:
- Saved searches and reports, split by who still opens them.
- Alerts and scheduled searches, with the action each one triggers.
- Dashboards, and the lookups, macros and event types they depend on.
- Data models and field extractions (props and transforms), which become ingest pipelines or schema in the new store.
- Correlation searches from Enterprise Security or ITSI services, if you use them.
- Collection: universal and heavy forwarders, the HTTP Event Collector, and the apps that parse vendor logs.
Treat each search as a rewrite in the target's language (OpenSearch DSL or PPL, ES|QL, LogQL or SQL) and test it by running both stores on the same sample and comparing result sets. Do not plan around automatic conversion of SPL. Keep Splunk running for a defined overlap period so detections do not go dark, and retire alerts by evidence of use rather than by calendar. A typical engagement of this kind is the saved-search parity assessment.
OpenSearch and Elastic: the search-engine route
Both are inverted-index search engines with ingest pipelines, dashboards and alerting. They suit teams that want full-text search across logs, flexible schemas and a large ecosystem of shippers. They also bring operating work Splunk hides: shard sizing, index lifecycle, mapping explosions, cluster upgrades, and disk and heap planning. The licence route differs (OpenSearch under Apache 2.0, Elastic under its three-way choice), and the security content differs too: Elastic ships prebuilt detection rules in Elastic Security, while OpenSearch has its Security Analytics plugin. AceMQ supports and operates both: OpenSearch consulting and support and ELK stack consulting and support.
Grafana Loki, ClickHouse and Datadog
Grafana Loki indexes labels and stores log chunks in object storage, which makes it cheap to retain and quick to search by label, and slower for free-text hunts across large ranges. It pairs with Prometheus and Grafana dashboards, and it has no SIEM content, so security detections need another home. Grafana support covers the stack. ClickHouse is an Apache 2.0 column store that handles very large event volumes with SQL; it has no log-specific UI or detection content, so you build or buy those. ClickHouse support covers the database. Datadog logs removes the operating work in return for usage-based billing and queries written in its own syntax and facets; Datadog consulting covers cost review. Treat Loki and ClickHouse as destinations for parts of the workload more often than as a one-for-one Splunk replacement.
Who should not leave Splunk
Stay if Enterprise Security is your SOC's working tool and the content, apps and analyst workflows are the product you rely on; replacing a SIEM is a programme of its own. Stay if your volume is mostly searched and retained for a reason. Stay if the real issue is an expiring contract and a negotiation gives you what you need; the attribution work in the first section strengthens that negotiation whatever you decide. Move if you have a clear platform reason, such as consolidating on an open store, and you can fund the dual-running period.
How we compared, and sources checked
We compared options on licence, query language, retention, detection parity and migration effort, from vendor and project pages. We give no ingest prices because Splunk publishes none, and we claim no migration result for AceMQ. All checked 4 November 2026: Splunk platform pricing, Splunk software support policy, Cisco on Splunk, OpenSearch Software Foundation announcement, Elastic's licensing announcement, Grafana Loki and ClickHouse. AceMQ is not a Splunk, Cisco, Elastic, Grafana, ClickHouse or Datadog partner or reseller, and gives no vendor licensing advice.
Frequently asked questions
What is the best alternative to Splunk?
It depends on the job. OpenSearch or Elastic suit teams that want a search-engine log store they run themselves, Grafana Loki suits troubleshooting logs next to metrics, ClickHouse suits SQL over very large volumes, and Datadog suits teams that want SaaS. If the problem is cost rather than platform, staying on Splunk with a smaller ingest is often the cheapest option.
How does Splunk charge for licences?
Per Splunk's platform pricing page, Splunk Cloud Platform offers activity-based, ingest or workload pricing and Splunk Enterprise offers data-ingest or workload pricing, all by quote with no published prices. Observability Cloud is priced per host. Check your contract for the metric and the overage terms.
Can SPL searches be converted automatically?
Plan as if they cannot. Each saved search, alert and dashboard needs rewriting in the target's language (DSL, PPL, ES|QL, LogQL or SQL) and testing on the same data. Counting them early is the most reliable way to size a migration.
Is Elasticsearch open source and is OpenSearch free?
Elasticsearch's source is available under AGPLv3, SSPL 1.0 or ELv2 at the user's choice, and the default distribution stays under ELv2. OpenSearch is Apache 2.0 under the OpenSearch Software Foundation. Both have free software and paid support or managed options.
Does AceMQ support Splunk, and will it migrate us off it?
AceMQ supports Splunk estates 24/7 and is independent of Splunk. For a move, AceMQ assesses the estate, maps searches, alerts and detections to a target and plans the migration; the target can be an AceMQ-supported platform such as OpenSearch, the ELK stack, Grafana or ClickHouse.
