What you runRunning Splunk?
Most of what you index is never searched. You pay for all of it.
Splunk is the most mature detection estate in the industry, and your SOC has years of tuned searches living in it. The pressure is the meter, not the platform: every GB that crosses into the indexers is licensed, searched or not.
Free. No system access. No obligation. You keep the drawing.
Step oneA pipeline in front of your SIEM, designed and built by Logmetry. Your SIEM stays. A full raw copy stays in your own account.
At least 20% less into your SIEM, every alert kept, proved on your data.
Splunk Enterprise Security SIEM
about $150 per GB/day a month
To ingest 1 GB every day for a month, at list price. An independent estimate.
Platform ingest license. Enterprise Security is priced on top of it.
Expanso, Splunk pricing guide, checked 2026-09-24
01The four problems
Which of these hits your Splunk estate?
Budget, renewals, the order to bring in AI, and collection that runs on someone else’s agents. Each one is about where the data lives, and with Splunk it lives in Splunk’s ecosystem. Pick yours.
“We’re told to index more, and the Splunk license won’t move.”
Pay Splunk for what your SOC searches. Keep everything else, clean, in your own Lake.
- Why it happens
Splunk licenses the GB per day that enters the indexers. Allow logs, debug output and duplicates cost the same as the events your detections read.
- What changes
A control layer in front of the indexers cleans, deduplicates and routes. The index gets what detection needs, and the full copy lands in a Lake you own.
- How sure you can be
Nothing is lost. The full copy stays in your Lake and replays on demand, and every routing rule is readable code. The reduction is measured on your own noisiest sources, before and after, in writing.
- How soon
With the first source. We start where the most volume sits, prove it, then continue.
- What it takes from you
Your diagrams and one call to start. We build it as code in your repositories and teach your team to run it.
What shrinks
- GB indexed by your SIEMOnly what detection reads is indexed. Duplicates, debug output and unread fields stay out.
- Tokens per AI investigationEvery query to the Lake returns only the fields the agent needs.
- Hosts on per-node licensesOrdinary hosts move to monitoring you own. The APM keeps the apps that earn it.
- Vendor licenses and modulesYou keep the features that earn their price, not the whole platform.
Shapes, not figures. Yours are measured on your own sources in the review.
“Every Splunk renewal costs more, and leaving feels impossible.”
Make the next Splunk renewal your choice. Negotiate from a smaller base.
- Why it happens
The forwarders, the index, SPL and the apps all live inside Splunk. Each module added is one more reason to stay, and the renewal prices the whole base.
- What changes
Collection and routing move into your account. Splunk keeps its detections, fed less. A second destination becomes a routing change, whenever you want one.
- How sure you can be
The detections, dashboards and alerts your team relies on keep firing where they do today. A move becomes a parallel run on the same routed feed, proven before anything is retired.
- How soon
Before your next renewal, if we start with the sources that drive it.
- What it takes from you
Your diagrams, your renewal date, and one call.
Your way out
- MigrationToday: Quarters of overlapping licensesWith you in control: Weeks: a parallel run, then a routing change
- Your dataToday: Their format, in their storeWith you in control: Open schemas, OCSF and OpenTelemetry, in your Lake
- HistoryToday: Stays behind when you leaveWith you in control: Replays into any tool you choose
- Collection and fleetToday: Their agents, their consoleWith you in control: A control layer and fleet plane you own
“We have to bring AI into the SOC, and Splunk’s answer is another module.”
Your agents, on your data, following your runbooks. Not one more module on their price list.
- Why it happens
Splunk’s AI reads what you paid to index, inside Splunk, sold as one more line on the renewal. It is their AI, on their rules and their runbooks, never yours.
- What changes
We trim every event in flight to only the fields an agent needs and land it in your Lake. When you add AI triage later, your agent runs in your account on a model you approve, reads that history read-only, and works the Splunk alerts you choose, with a person on every exception.
- How sure you can be
Agents reason well on clean, trimmed data and badly on noise. Knowing which fields matter takes understanding machine data, source by source, and that is the work we do.
- How soon
As soon as the first sources land clean in your Lake, your agent has something worth reading.
- What it takes from you
Your runbooks, or we write them with you. The agents, prompts and runbooks are code you own.
What you get running
- Agents you control, in your accountThey run where your data is, under your access rules.
- Models you choose, and swapSmall or open-weight models for routine alerts, larger ones for investigations. Changing one is a config change, not a renewal.
- Your runbooks, as codeVersioned in your repositories. The agent follows them step by step.
- Token controlFields trimmed in flight to what the agent needs, so every query reads less and costs less.
- Fixes as pull requestsThe agent writes the fix, a person approves it, and remediation moves at the speed of a review.
- A Lake anyone can queryDevelopers and stakeholders ask the clean Lake directly, at object-storage prices.
“We want one open standard, not a Splunk forwarder on every host.”
LaterA later step, sold only after step one is proved on your data.
Open collection you own. Splunk becomes one destination among several.
- Why it happens
The Universal Forwarder speaks Splunk first, so collection is where the lock-in starts, before the license.
- What changes
The forwarders stay while the logs work lands. Open collection on OpenTelemetry follows host group by host group, routed to Splunk and anywhere else.
- How sure you can be
OpenTelemetry is the open standard the major APM vendors already accept. Nothing about your destinations has to change on day one.
- How soon
Later. We start with the logs in front of your SIEM, because that is where the money is. Open collection follows once that is proved, host group by host group.
- What it takes from you
Your diagrams and one call. We plan the order with you.
Your control plane
- OpenTelemetry collectorsOpenOne open collector on every host, built for your estate.
- A fleet plane you ownYoursConfiguration and rollout from a console in your account, under OpAMP.
- Changes as pull requestsAs codeAI native: an assistant drafts the change, your team reviews and merges it.
- No vendor agentsRemovedNothing on a host reports to someone else’s console.
- Monitoring, only what earns itYour callStep away from a vendor’s full architecture and keep only the features you value.
02Today, and after
Today, and with the Blueprint
A Splunk estate pays per GB at the indexer door for everything it keeps, and what never earns that price is simply never collected.
Scroll the drawing sideways to see all of it.
What Splunk does best
Splunk is the most mature detection estate in the industry. The search language is unmatched for investigation, the app and add-on ecosystem covers almost every source that exists, and your SOC has years of muscle memory, saved searches and tuned detections living in it. That is real value, and ripping it out would burn it.
The pressure is the meter, not the platform. Splunk licenses by the GB per day that enters the indexers, so the contract grows with volume whether or not anyone searches it. Firewall allow logs, debug output and duplicate events pay the same rate as the events your detections read.
How it works, and where we sit
Splunk is the SIEM most SOCs grew up in: a Universal Forwarder on every host, Heavy Forwarders parsing and routing in the middle, indexers storing what arrives, and search heads where the detections live as correlation searches over CIM-normalized data models. It is licensed by the GB per day that crosses into the indexers, and only that meter counts. We keep the detections your SOC trusts, govern what enters that per-GB index, and land everything else in full-fidelity storage you own.
03The five verbs
What we keep, and what changes
Keep it and govern what flows in, shrink its footprint, cut what it costs, extend it with an agent, and replace only where replacement is honest.
- Keep
The detections, the saved searches, the correlation searches, and the estate your SOC knows by heart. Nothing about how your team works in Splunk changes, and nothing they built there is thrown away.
- Shrink
Firewall allow logs, debug output, and duplicates route to full-fidelity open-format storage instead of the per-GB index, and stay replayable.
- Cut
The renewal then prices a much smaller base, and the reduction is proven source by source rather than promised, with the before and after measured in writing on your own top talkers.
- Extend
An agent you own investigates the alerts Splunk fires, reading enriched history from the Lake beside it.
- Replace
Never. Splunk is a SIEM and we sit in front of SIEMs, not in place of them. If you ever choose to leave, the exit is a parallel run and a routing change, and the choice stays yours.
The letters mark where each verb acts in the drawing with the Blueprint.
How the control layer changes the Splunk math
A control layer in front of Splunk inspects every event in flight, keeps a full-fidelity copy in cheap open-format storage, and forwards only high-value data into the per-GB index.
We work at config level: forwarders and inputs, props and transforms, CIM alignment. Normalization moves upstream into the control layer, so parsing logic is maintained once instead of per source inside Splunk. Nothing is dropped silently, and the filtered copy stays queryable for investigation, audit, and compliance.
When the day comes to evaluate an alternative, the same layer runs Splunk and a candidate platform in parallel on live data, so the decision is made on evidence and the cutover is a routing change.
04The free architecture review
We draw your Splunk estate, free.
Telemetry engineers look at your whole environment and show you exactly where the cost, the waste and the hurdles are, and what your architecture could look like. No strings attached.
What you get
- Your Splunk architecture today, drawnEvery source, pipeline and destination, as it actually flows.
- The waste mapWhere you pay for data nobody reads, and what it costs you each year.
- Costs before and after, with estimatesWhat you spend now, and what the same coverage would cost.
- Your target architectureWhat your Splunk estate could look like, drawn on your own sources.
- Options for your business problemNot one product. The choices, with what each one costs and changes.
Who does it
A lead architect with 26 years in monitoring and observability, leading a team of senior engineers in telemetry engineering and pipeline design. The team that reviews it is the team that would build it.
What it takes from you
Your diagrams and one call. No system access.
What comes next
If it pays, a two-week proof of value on your noisiest source, free unless you go ahead. At least 20% less into your SIEM, every alert kept, proved on your data.
What it costs
Nothing
No strings attached. You keep the drawing, whatever you decide.
05Questions
What Splunk teams ask before they book
Do you replace Splunk?
No. We sit in front of it. Splunk keeps the detections, saved searches and dashboards your SOC relies on, fed exactly the data they need. Leaving becomes possible, never required.
Does reducing Splunk ingest mean losing data?
No. Reduction is a routing decision, not deletion. Everything lands in full-fidelity open-format storage you own, and any of it replays into Splunk or any other destination when an investigation or audit wants it. What changes is what pays the index price.
Will our detections break?
The routing split is designed against your detection set: high-value security events keep flowing to Splunk unchanged, and every change is validated with your rules firing on real data before it ships. Detections keep their inputs, on a fraction of the volume.
Why is the review free?
Because the drawing is how you judge us. You see your own architecture, your waste and your options before you spend anything, and you keep the drawing whatever you decide. No system access, no obligation.
Are you a reseller for a vendor?
Yes, for certain vendors’ software. We are also the delivery partner and integrator on custom projects, directly or alongside your systems integrator. The pipeline subscription is in your name, bought from the vendor, its channel or through Logmetry where we resell it, and priced on its own line. We recommend what fits your business problem, even when that means changing nothing, and no SIEM or APM vendor pays us to recommend it.
What if the savings don’t hold on our data?
You see it measured before you commit. The two-week proof of value runs on your noisiest source, with success criteria signed before it starts, measured in your SIEM’s own license usage view. At least 20% less into your SIEM, every alert kept, proved on your data.
See your Splunk estate drawn, with the costs, before you spend anything
Run by a lead architect with 26 years in monitoring and observability. No system access, no charge, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing