CompareUpdated 2026-09-22
Observability data ownership: vendor-hosted vs a lake on Iceberg
Vendor-hosted telemetry is kept for the retention you buy and read back through that vendor's tools, while a lake on an open table format like Apache Iceberg holds full history in your own storage that any compatible engine can read.
16cells, every one sourced and dated
Side by side
From the vendors' own pages
- Datadog pricing list
- Splunk Cloud Platform docs, Dynamic Data Self Storage
- Microsoft Learn, Sentinel data tiers and retention
- Amazon S3 pricing page
- Splunk pricing page
- Microsoft Sentinel pricing page
- Datadog docs, Log Archives
- Microsoft Learn, Log Analytics data export
- Apache Iceberg project
- Datadog docs, Rehydrating from Archives
A cell without a source does not ship.
01The mechanics
What actually differs
The unit each option charges on, and who owns what afterwards, matter more than any single quoted figure.
Telemetry is the logs, metrics, and traces your systems emit. Every platform hosts it as part of the service, and each prices retention so that keeping everything in the searchable tier costs more than most teams will pay. The result is history scattered across vendor retention windows, none of it complete, each piece read back through that vendor's own tools and exported on that vendor's terms.
The vendors do offer a way out, and the table shows how each one works: a copy in a bucket you own, in a format they choose, that comes back in only in certain ways. The alternative is to make your own storage the primary home. Full history lands in object storage in your cloud account, as tables in Apache Iceberg, an open table format that many query engines read. Retention becomes a storage-class decision instead of a licensing negotiation, and the history stays readable by whatever engine or model comes next.
02The facts
Side by side, sourced
Every cell in this table carries the vendor's own page as its source and the date it was checked, and a cell without a source does not ship.
| Datadog | Splunk Cloud Platform | Microsoft Sentinel | Your lake on Iceberg | |
|---|---|---|---|---|
| How long it stays | Standard log indexing is sold by retention period: 3, 7, 15, or 30 days. Flex Logs Starter keeps events for 6, 12, or 15 months.Datadog pricing list, checked 2026-09-22 | Each index keeps data for the retention period you configure. At the end, data is deleted or, with Dynamic Data Self Storage, moved out to storage you own.Splunk Cloud Platform docs, Dynamic Data Self Storage, checked 2026-09-22 | The analytics tier includes 90 days for Sentinel data, extendable to two years for a monthly charge. The data lake tier mirrors it and can extend total retention to 12 years.Microsoft Learn, Sentinel data tiers and retention, checked 2026-09-22 | As long as your own storage rules say. AWS lists S3 Glacier Deep Archive for data read once or twice a year and restorable within 12 hours.Amazon S3 pricing page, checked 2026-09-22 |
| What keeping it costs | Datadog lists ingestion at $0.10 per GB, then indexing from $1.06 per million events for 3 days to $2.50 for 30 days, billed annually.Forwarding logs to a custom destination is listed at $0.25 per GB outbound, per destination.Datadog pricing list, checked 2026-09-22 | No storage rate is published. Storage sits inside quoted subscriptions and Cloud Flex, which covers Splunk Storage and Federated Search.Splunk pricing page, checked 2026-09-22 | Microsoft lists data lake storage at $0.026 per GB a month, data lake ingestion at $0.05 per GB, and data lake queries at $0.005 per GB analyzed.Microsoft Sentinel pricing page, checked 2026-09-22 | AWS lists S3 Standard at $0.023 per GB a month for the first 50 TB and S3 Glacier Instant Retrieval at $0.004, in US East.Reads by AWS services in the same region carry no transfer charge. Transfer out to the internet is $0.09 per GB for the first 10 TB a month.Amazon S3 pricing page, checked 2026-09-22 |
| The copy you own | Archives send every ingested log, indexed or not, to your own S3, Azure Storage, or Google Cloud Storage bucket, as compressed JSON filed by date and hour.Datadog docs, Log Archives, checked 2026-09-22 | Expired data moves to your own S3 or Google Cloud Storage bucket. Only the raw data journal is kept, not the index files, and Splunk keeps no copy.Splunk Cloud Platform docs, Dynamic Data Self Storage, checked 2026-09-22 | Data export rules copy chosen tables continuously to your Azure Blob Storage or Event Hubs, as uncompressed JSON lines, charged per GB exported.Microsoft Learn, Log Analytics data export, checked 2026-09-22 | The lake is the primary copy, as Iceberg tables. Columns can be added or renamed without rewriting a table, and time travel reruns a query on any past snapshot.Apache Iceberg project, checked 2026-09-22 |
| Reading old data back | Rehydration loads archived events back into Datadog, up to 1 billion per historical view, and every scanned and indexed log is billed.Datadog docs, Rehydrating from Archives, checked 2026-09-22 | Restore only into a Splunk Enterprise instance, one bucket at a time, then rebuild the index. Self-stored data cannot go back into Splunk Cloud Platform.Splunk Cloud Platform docs, Dynamic Data Self Storage, checked 2026-09-22 | The data lake tier is read with KQL (Kusto Query Language) or scheduled Spark jobs, with slower queries and limits on analytics rules, hunting queries, and workbooks.Microsoft Learn, Sentinel data tiers and retention, checked 2026-09-22 | Any engine that reads Iceberg. The Apache Iceberg project names Spark, Trino, Flink, Presto, Hive, and Impala working on the same tables at the same time.Apache Iceberg project, checked 2026-09-22 |
03The honest row
When each is the right answer
Every option in this comparison is the right answer for somebody, and saying when is the part most comparisons leave out.
Vendor-hosted
The right answer for the hot window: the recent data your detections, alerts, and dashboards read every minute, where the platform's query speed and integrations earn the hosting fee. The mistake is not keeping data there, it is letting that window decide what you keep at all.
The vendor's own archive
The right answer when you run one platform, expect to stay, and mostly need the archive for audits. Datadog Archives, Splunk's Dynamic Data Self Storage, and Sentinel's data lake tier all keep history cheaper than the hot tier, as long as you accept that reading it back runs through that vendor's tools.
Lake on Iceberg
The right answer for full history across more than one platform: object-storage prices, compliance evidence on demand, replay into any tool, and one foundation for AI agents to read. Not a replacement for the platforms, the ground beneath them.
04Questions
Asked about this comparison
Is a telemetry lake a SIEM replacement?
No, and it should never alert. Detection stays on the SIEM (security information and event management platform), which is built for it. The lake holds the full history the SIEM should not have to, serves audits and investigations, and feeds the agents. The two are complements priced for different jobs.
The vendors already archive to my bucket. Why is that not enough?
Because the format and the way back are still theirs. Datadog archives land as compressed JSON that returns through rehydration, which Datadog bills. Splunk's archive keeps only the raw data journal, which restores only into Splunk Enterprise. Sentinel exports uncompressed JSON lines billed per GB. Each is a copy you can parse yourself, but none arrives as tables that every engine can query without rebuilding them first.
Why do open table formats matter for AI?
Because the model you run next year may not exist yet, and neither may its vendor. History held in a format one vendor controls is readable on that vendor's roadmap. History in Apache Iceberg is readable by every engine that speaks the format, which is what makes it a foundation rather than an archive.
Model it against your estate
The comparison that matters is the one run on your volumes and your contracts. The review reads them with you, and you leave with your version of the Logmetry Blueprint. No system access, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing