CompareUpdated 2026-09-22
SIEM pricing models: Splunk vs Microsoft Sentinel vs Elastic
Splunk prices on ingest, workload, or search activity and publishes no platform rates, Microsoft Sentinel publishes a per-GB rate with daily commitment tiers, and Elastic prices on resources when hosted but per GB ingested and retained on serverless.
15cells, every one sourced and dated
Side by side
From the vendors' own pages
- Splunk pricing models page
- Microsoft Sentinel pricing page
- Elastic pricing page
- Splunk pricing page
- Elastic Security Serverless pricing page
- Elastic Cloud Hosted pricing page
A cell without a source does not ship.
01The mechanics
What actually differs
The unit each option charges on, and who owns what afterwards, matter more than any single quoted figure.
A SIEM (security information and event management platform) collects security logs, runs detection rules over them, and keeps them for investigations. The three platforms here charge on different units, which is why comparing quotes line by line misleads. An ingest-priced SIEM bills on every gigabyte (GB) that flows in, whether or not anyone reads it. A resource-priced one bills on the compute and memory the deployment holds. The unit decides what behaviour gets expensive, and so what the pricing quietly encourages.
How much each vendor publishes differs too. Microsoft lists Sentinel rates per GB and per daily tier as estimates, Elastic lists per-GB rates for its serverless security product, and Splunk lists no rate for its platform or for Enterprise Security. The honest comparison is the mechanics: the unit, what is published, how commitment works, what a spike costs, and where long-term data can sit for less. That is what the table below holds, each cell sourced from the vendor's own page with the date we checked it.
02The facts
Side by side, sourced
Every cell in this table carries the vendor's own page as its source and the date it was checked, and a cell without a source does not ship.
| Splunk | Microsoft Sentinel | Elastic | |
|---|---|---|---|
| Pricing unit | Three models: activity-based (ingest plus search activity), workload (compute, measured in Splunk Virtual Compute units on Splunk Cloud Platform), or ingest (GB of data taken in). Unlimited users on each.Activity-based pricing is offered on Splunk Cloud Platform only. Splunk Enterprise, the self-managed product, offers ingest or workload.Splunk pricing models page, checked 2026-09-22 | Per GB, into one of two tiers. The analytics tier runs detections, alerts, and full queries. The data lake tier is low-cost long-term storage with its own meters for ingestion, processing, query, and storage.Microsoft Sentinel pricing page, checked 2026-09-22 | Depends on how it is deployed. Elastic Cloud Hosted is resource based, Elastic Cloud Serverless is usage based, and self-managed is licensed on the number of nodes and the RAM they use.Elastic pricing page, checked 2026-09-22 |
| Published rate | None for Splunk Platform or Enterprise Security. Every path on the page ends at a quote request. Splunk does list host-based rates for its observability products on the same page.Splunk pricing page, checked 2026-09-22 | Microsoft lists pay-as-you-go analytics ingestion at $4.30 per GB in East US, and the 100 GB a day commitment tier at $296 a day.Microsoft marks these as estimates that vary by agreement, purchase date, currency, and taxes.Microsoft Sentinel pricing page, checked 2026-09-22 | Elastic lists Elastic Security Serverless ingest from $0.09 per GB and retention from $0.017 per GB a month, or $0.11 and $0.019 on its recommended tier.Elastic states per-endpoint fees stopped applying on March 23, 2026. Ingest and retention charges still apply.Elastic Security Serverless pricing page, checked 2026-09-22 |
| Commitment mechanics | Annual subscriptions on Splunk Cloud Platform and term licenses on premises, agreed through sales. Cloud Flex lets committed spend move between Splunk products without a new procurement.Splunk pricing models page, checked 2026-09-22 | Commitment tiers reserve 100 GB to 50,000 GB a day for a fixed daily fee, with savings Microsoft states as up to 52% against pay-as-you-go. Upgrade any time, downgrade only after 31 days.Microsoft Sentinel pricing page, checked 2026-09-22 | Pay as you go monthly, or prepaid, on both Elastic Cloud Hosted and Serverless. Self-managed runs on a Platinum or Enterprise subscription.Elastic pricing page, checked 2026-09-22 |
| When volume spikes | Splunk states it charges overage only when you consistently exceed the ingestion or storage capacity you bought, so a short spike during an incident is absorbed.Splunk pricing page, checked 2026-09-22 | Usage above the commitment tier bills at the same discounted rate. Tiers apply per workspace and cannot be grouped across workspaces or subscriptions.Microsoft Sentinel pricing page, checked 2026-09-22 | On Serverless, a spike is simply more GB ingested and retained that month. Elastic describes the model as having no monthly overages or committed spends.Elastic Security Serverless pricing page, checked 2026-09-22 |
| Cheaper home for old data | Federated Search analyzes data where it already lives, such as Amazon S3, instead of ingesting it. Ingest and Edge Processors filter data before it is indexed.Splunk pricing page, checked 2026-09-22 | The data lake tier, which Microsoft lists at $0.05 per GB ingested and $0.026 per GB a month stored. Microsoft positions it for firewall, network, and proxy logs kept for forensics, not real-time detection.Microsoft Sentinel pricing page, checked 2026-09-22 | Searchable snapshots in cold and frozen tiers keep long retention searchable. On Elastic Cloud Hosted they come with the Enterprise subscription tier.Elastic Cloud Hosted pricing page, checked 2026-09-22 |
03The honest row
When each is the right answer
Every option in this comparison is the right answer for somebody, and saying when is the part most comparisons leave out.
Splunk
The right answer when your detection content and your team's SPL (Splunk's search language) run deep, when the estate is hybrid or on premises, and when it has to run air-gapped, which Splunk Enterprise supports. Years of tuned detections are the asset, and governing what gets indexed costs less than rebuilding them elsewhere.
Microsoft Sentinel
The right answer for Microsoft-heavy estates, where Defender, Entra, and Microsoft 365 signals are already there, and where one workspace carries a steady daily volume that fits a commitment tier. The data lake tier then gives high-volume network and firewall logs a far cheaper home inside the same product.
Elastic
The right answer for engineering-led teams who want a published per-GB rate they can model on day one with Serverless, or full control of a self-managed cluster licensed by node and RAM, and who want security and observability search on one platform.
04Questions
Asked about this comparison
Which of these vendors publish a price?
Microsoft publishes Sentinel's per-GB and daily tier rates as estimates, and Elastic publishes per-GB rates for its serverless security product. Splunk publishes no rate for its platform or for Enterprise Security, and every path ends at a quote. Large deals are negotiated on volume, term, and bundling with all three, so the published unit and commitment mechanics matter more to your planning than any single figure.
Which pricing model is cheapest?
The one whose unit matches how your data behaves, and only once that data is governed. Ingest pricing punishes verbose sources, so it rewards a control layer that filters and routes before the SIEM. Resource and workload pricing punish heavy search and long retention in the hot tier. The honest answer comes from modelling your own volumes, which is what the architecture review does.
Does a control layer change which SIEM wins?
It changes the stakes. With routing in front, each SIEM receives only the data that earns its tier, full history lands in storage you own, and the data side of a later switch becomes a routing change. Detection content still has to move by hand, but the decision stops being a one-way door.
Model it against your estate
The comparison that matters is the one run on your volumes and your contracts. The review reads them with you, and you leave with your version of the Logmetry Blueprint. No system access, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing