Skip to content
Logmetry
What we solve
SIEM and log costClean data for AI agentsCoverage, audit and PIIVendor independenceSIEM migrationObservability modernizationAll problems we solve
Who it’s for
For the CISOFor the CIO and CTOFor the CFOFor Architects
Platforms
SplunkMicrosoft SentinelCrowdStrikeElasticDatadogDynatraceSplunk ObservabilitySolarWindsCriblOpenTelemetryA Data LakeCompare the options
The Blueprint
The whole methodPhase 01 · FoundationPhase 02 · AI triagePhase 03 · RemediationPhase 04 · FootprintEverything as codeAI native
JournalAbout
About LogmetryYour teamTrust and securityStep one and the proofWhere we fit
Book the review

CompareUpdated 2026-09-22

Collection agents: vendor agents vs the OpenTelemetry Collector

A vendor agent is built to feed one platform and is paid for through that platform's bill, while the OpenTelemetry Collector is open source, carries no license fee, and sends the same host signals to one or more destinations you choose.

15cells, every one sourced and dated

Side by side

Datadog Agent, Splunk Universal Forwarder, OpenTelemetry Collector

From the vendors' own pages

  • Datadog pricing
  • Splunk pricing
  • OpenTelemetry, What is OpenTelemetry
  • Datadog docs, Dual shipping
  • Splunk docs, Forward data to third-party systems
  • OpenTelemetry docs, Collector
  • Datadog docs, Windows Event Log
  • Splunk docs, Monitor Windows event log data
  • OpenTelemetry Collector contrib, windowseventlogreceiver
  • Datadog docs, OTLP ingestion by the Agent
  • Splunk docs, Use the Universal Forwarder with the Collector
  • Datadog docs, Fleet Automation
  • Splunk docs, About deployment server and forwarder management
  • OpenTelemetry, OpAMP specification

A cell without a source does not ship.

01The mechanics

What actually differs

The unit each option charges on, and who owns what afterwards, matter more than any single quoted figure.

Vendor agents versus the OpenTelemetry CollectorA vendor agent collects for one destination and is billed through that vendor, so most hosts carry several agents collecting overlapping signals. The OpenTelemetry Collector reads the same host signals with no per-agent license and sends them to the destinations you choose, including a lake you own.VENDOR AGENTSONE HOSTAgent oneAgent twoAgent threeITS SIEM, ONLYITS APM, ONLYITS MONITOR, ONLYSeveral agents per host, collectingoverlapping signals, each built for onedestination and billed under its model.OPENTELEMETRY COLLECTORONE HOSTOne collectorNo per-agent licenseANY SIEMANY APMTHE LAKE YOU OWNOne open collector reads the same hostsignals with no per-agent license, andsends them to the destinations you choose.
The lock and the fan. Vendor agents bind each host signal to one destination each, the open collector reads the host once and sends anywhere. That difference is what makes every later decision reversible.

An agent is the small program installed on a server to collect its telemetry: the logs, the performance numbers, and the traces that follow one request through an application. Most servers carry several, because operations and security each install their own for the same host. The agent is also how a platform makes itself sticky, because leaving the platform means touching every host it ever instrumented.

OpenTelemetry is the open standard for telemetry, run by the Cloud Native Computing Foundation (CNCF), and its Collector is the open source agent that goes with it. It reads host metrics, the Windows event log, syslog, application log files, Kubernetes, and the metrics endpoints your services already expose, with nothing changed in any application. Traces are the one signal that needs the application's cooperation, and for most runtimes that is a flag or a wrapper.

The honest gap: the Collector's Windows event log receiver is still rated alpha by the OpenTelemetry project, while the Datadog Agent and the Splunk Universal Forwarder have collected Windows events for years. The vendors themselves now ship their own builds of the OpenTelemetry Collector, which says where collection is heading.

02The facts

Side by side, sourced

Every cell in this table carries the vendor's own page as its source and the date it was checked, and a cell without a source does not ship.

Collection agents: vendor agents vs the OpenTelemetry Collector, side by side, every cell with its source and the date it was checked
Datadog AgentSplunk Universal ForwarderOpenTelemetry Collector
How the bill is countedPer host monitored. Datadog lists Infrastructure Pro at $15 per host per month on an annual plan.Datadog counts any physical or virtual operating system instance it monitors as a host.Datadog pricing, checked 2026-09-22Through the Splunk platform, which Splunk prices on ingest, workload or activity rather than per forwarder.Splunk pricing, checked 2026-09-22Open source, with no license fee. OpenTelemetry is not a backend, so the only bill is the destination you send to.OpenTelemetry, What is OpenTelemetry, checked 2026-09-22
Where the data can goDatadog. Dual shipping reaches other Datadog organizations and sites, and Datadog points to its Observability Pipelines product for other vendors.Datadog docs, Dual shipping, checked 2026-09-22A Splunk receiver as a rule. It can send raw TCP data to a third-party system, but it cannot route or filter, and it has no syslog output.Splunk docs, Forward data to third-party systems, checked 2026-09-22One or more open source or commercial backends at the same time.OpenTelemetry docs, Collector, checked 2026-09-22
Windows event logYes. The Windows Event Log check ships in the Agent package with nothing extra to install.Datadog docs, Windows Event Log, checked 2026-09-22Yes. Splunk names the universal forwarder as the best practice for sending event logs from remote machines.Splunk docs, Monitor Windows event log data, checked 2026-09-22Yes, through the Windows event log receiver, which the project rates alpha and ships in the contrib distribution.OpenTelemetry Collector contrib, windowseventlogreceiver, checked 2026-09-22
Application tracesYes. It also accepts OpenTelemetry traces, metrics and logs over OTLP (the OpenTelemetry wire protocol), then sends them to Datadog.Datadog docs, OTLP ingestion by the Agent, checked 2026-09-22No. Splunk uses the forwarder for logs and some metrics, and its OpenTelemetry Collector build for traces.Splunk docs, Use the Universal Forwarder with the Collector, checked 2026-09-22Yes. Traces, metrics and logs are the three signals OpenTelemetry defines.OpenTelemetry, What is OpenTelemetry, checked 2026-09-22
Fleet controlFleet Automation, inside the Datadog web app: view and change Agent configuration, and upgrade Agent versions.Datadog docs, Fleet Automation, checked 2026-09-22The deployment server, part of your own Splunk Enterprise, sends configuration to groups of forwarders.Splunk docs, About deployment server and forwarder management, checked 2026-09-22Any server that speaks the Open Agent Management Protocol (OpAMP), an OpenTelemetry specification still at Beta.The agent opens the connection to the server, over WebSocket or plain HTTP.OpenTelemetry, OpAMP specification, checked 2026-09-22

03The honest row

When each is the right answer

Every option in this comparison is the right answer for somebody, and saying when is the part most comparisons leave out.

  • Vendor agents

    The right answer on the crown-jewel hosts where a platform's deep tracing, profiling or eBPF-level visibility (kernel-level instrumentation) is actually used, because that depth is what the agent exists to feed and the open collector does not replicate all of it. Also the safer answer today for Windows-heavy estates that lean on the event log, where the vendor agents are mature and the open receiver is still alpha.

  • OpenTelemetry Collector

    The right answer for the ordinary tier of every estate: the hosts whose signals are logs, host metrics, and basic checks. One collector, open source with no license fee, one or more destinations, and a fleet you can control from your own repository over an open protocol.

04Questions

Asked about this comparison

Can the OpenTelemetry Collector really replace our vendor agents?

On the ordinary tier, mostly yes. Host metrics, log files, syslog, Kubernetes, and the metrics endpoints your services already expose all collect with nothing changed in applications. The Windows event log receiver is still rated alpha by the OpenTelemetry project, so test it on your own channels first. On hosts using deep vendor tracing or profiling, the honest answer is to keep the vendor agent there, scoped to the paths that earn it.

Is the Datadog Agent not open source too?

It is, and Datadog publishes its code. The difference is where the data goes and how it is paid for. The Datadog Agent ships to Datadog and the bill is counted per host monitored, while the OpenTelemetry Collector sends to whichever backends you configure and carries no license fee of its own.

What breaks when an agent is swapped?

Alerting and dashboards, unless parity comes first. The migration exports the monitors and alert rules through each platform's own interfaces, rebuilds them against the open pipeline, and proves them in writing before hosts move. The swap is a project with a gate, not an uninstall.

Model it against your estate

The comparison that matters is the one run on your volumes and your contracts. The review reads them with you, and you leave with your version of the Logmetry Blueprint. No system access, no obligation.

Book the architecture reviewOr take the Blueprint as a PDF →

Free. No system access. No obligation. You keep the drawing.

What you get

  • Your architecture today, drawn
  • The waste map
  • Costs before and after, with estimates
  • Your target architecture
  • Options for your business problem

What it costsNothing