What you runRunning Splunk Observability Cloud?
Your collection is already open. Your bill still counts every host.
Splunk Observability Cloud is built on OpenTelemetry, with streaming metrics and full-fidelity tracing that engineers rate highly. The pressure is the host meter: every monitored host is priced, with a higher tier for hosts that carry APM.
Free. No system access. No obligation. You keep the drawing.
Splunk Observability Cloud APM and monitoring
$15 per host a month
To monitor one host for a month, at list price.
App and Infra, with APM, starts at $60 per host a month.
Splunk Observability Cloud pricing, checked 2026-09-24
01The four problems
Which of these hits your Splunk Observability estate?
Budget, renewals, the order to bring in AI, and collection that runs on someone else’s agents. Each one is about where the data lives, and with Splunk Observability it lives in Splunk Observability’s ecosystem. Pick yours.
“Every host we add is another line on the Splunk Observability bill, whatever it runs.”
Pay the host meter for the apps that need it. Watch the rest on a store you own.
- Why it happens
Every monitored host is priced, and APM hosts pay a higher tier. Ordinary nodes on basic checks sit on the same meter as the services that matter.
- What changes
APM stays on the crown-jewel apps. The same collectors send the ordinary tier to a store you own, with each alert proven in writing first.
- How sure you can be
Nothing is lost. The full copy stays in your Lake and replays on demand, and every routing rule is readable code. The reduction is measured on your own noisiest sources, before and after, in writing.
- How soon
With the first source. We start where the most volume sits, prove it, then continue.
- What it takes from you
Your diagrams and one call to start. We build it as code in your repositories and teach your team to run it.
What shrinks
- GB indexed by your SIEMOnly what detection reads is indexed. Duplicates, debug output and unread fields stay out.
- Tokens per AI investigationEvery query to the Lake returns only the fields the agent needs.
- Hosts on per-node licensesOrdinary hosts move to monitoring you own. The APM keeps the apps that earn it.
- Vendor licenses and modulesYou keep the features that earn their price, not the whole platform.
Shapes, not figures. Yours are measured on your own sources in the review.
“Observability and our Splunk logs keep getting bundled into one renewal.”
Keep Splunk where it earns its tier. Make the rest a choice.
- Why it happens
Infrastructure, APM, logs and the Splunk platform are sold as one family. Each tier added is one more reason to renew the whole of it.
- What changes
Collection and routing are configured by you, from your repository. Splunk keeps APM, and the ordinary tier and the history live in your account.
- How sure you can be
The detections, dashboards and alerts your team relies on keep firing where they do today. A move becomes a parallel run on the same routed feed, proven before anything is retired.
- How soon
Before your next renewal, if we start with the sources that drive it.
- What it takes from you
Your diagrams, your renewal date, and one call.
Your way out
- MigrationToday: Quarters of overlapping licensesWith you in control: Weeks: a parallel run, then a routing change
- Your dataToday: Their format, in their storeWith you in control: Open schemas, OCSF and OpenTelemetry, in your Lake
- HistoryToday: Stays behind when you leaveWith you in control: Replays into any tool you choose
- Collection and fleetToday: Their agents, their consoleWith you in control: A control layer and fleet plane you own
“We want AI on our incidents, and the suite’s AI reads only what the suite holds.”
Your agents, on your data, following your runbooks. Not one more module on their price list.
- Why it happens
The suite’s AI reasons over the data the suite holds, on its price list. It is their AI, on their rules and their runbooks, never yours.
- What changes
We trim every event in flight to only the fields an agent needs and land it in your Lake. When you add AI triage later, your agent runs in your account on a model you approve, follows the trace ID into the history around it, read-only, and works the alerts you choose, with a person on every exception.
- How sure you can be
Agents reason well on clean, trimmed data and badly on noise. Knowing which fields matter takes understanding machine data, source by source, and that is the work we do.
- How soon
As soon as the first sources land clean in your Lake, your agent has something worth reading.
- What it takes from you
Your runbooks, or we write them with you. The agents, prompts and runbooks are code you own.
What you get running
- Agents you control, in your accountThey run where your data is, under your access rules.
- Models you choose, and swapSmall or open-weight models for routine alerts, larger ones for investigations. Changing one is a config change, not a renewal.
- Your runbooks, as codeVersioned in your repositories. The agent follows them step by step.
- Token controlFields trimmed in flight to what the agent needs, so every query reads less and costs less.
- Fixes as pull requestsThe agent writes the fix, a person approves it, and remediation moves at the speed of a review.
- A Lake anyone can queryDevelopers and stakeholders ask the clean Lake directly, at object-storage prices.
“We chose OpenTelemetry. Why does it still feel like Splunk’s collector?”
LaterA later step, sold only after step one is proved on your data.
The same open collectors, configured and routed by you.
- Why it happens
Splunk ships its own distribution of the OpenTelemetry Collector, configured for Splunk first.
- What changes
The collectors stay open and move under a console you own. Splunk becomes one destination, and nothing is re-instrumented.
- How sure you can be
OpenTelemetry is the open standard the major APM vendors already accept. Nothing about your destinations has to change on day one.
- How soon
Later. We start with the logs in front of your SIEM, because that is where the money is. Open collection follows once that is proved, host group by host group.
- What it takes from you
Your diagrams and one call. We plan the order with you.
Your control plane
- OpenTelemetry collectorsOpenOne open collector on every host, built for your estate.
- A fleet plane you ownYoursConfiguration and rollout from a console in your account, under OpAMP.
- Changes as pull requestsAs codeAI native: an assistant drafts the change, your team reviews and merges it.
- No vendor agentsRemovedNothing on a host reports to someone else’s console.
- Monitoring, only what earns itYour callStep away from a vendor’s full architecture and keep only the features you value.
02Today, and after
Today, and with the Blueprint
A Splunk Observability estate already collects on OpenTelemetry, yet every host sits on the host meter, and ordinary nodes pay the host rate for basic checks.
Scroll the drawing sideways to see all of it.
What Splunk Observability Cloud does best
Splunk Observability Cloud took the open road early: collection runs on Splunk’s distribution of the OpenTelemetry Collector, metrics stream in real time, and APM keeps full-fidelity traces instead of sampling them away. For engineering teams that want depth on standard instrumentation, that is a strong position.
The pressure is the host meter. Every monitored host is priced, and hosts that carry APM pay a higher tier, so the bill grows with the host count whether a node runs a revenue-critical service or basic checks. Because the collection is already open, the ordinary tier is the easiest in the market to move.
How it works, and where we sit
Splunk Observability Cloud is the observability suite built on OpenTelemetry: Splunk’s distribution of the OpenTelemetry Collector runs on every host, infrastructure monitoring streams metrics in real time, and APM keeps full-fidelity traces. It is priced per host, in tiers: infrastructure, app and infrastructure with APM, and end to end. Because collection already speaks the open standard, we keep APM where it earns its tier, route the same collectors to a store you own for the ordinary hosts, and keep the full history in a Lake.
03The five verbs
What we keep, and what changes
Keep it and govern what flows in, shrink its footprint, cut what it costs, extend it with an agent, and replace only where replacement is honest.
- Keep
APM and full-fidelity tracing on the crown-jewel apps, where the higher host tier earns its price, and the dashboards your engineers rely on there.
- Shrink
The priced host count contracts to the apps that need depth, scoped and written down before the renewal conversation.
- Cut
The ordinary tier comes off per-host pricing entirely, onto the same OpenTelemetry collectors and an open source time series database you own.
- Extend
Traces and logs land in the Lake carrying the same trace ID, so an agent you own, added later, can follow the alerts you choose into the history around it, read-only.
- Replace
Only the per-host infrastructure tier, and only with each alert rebuilt and proven to behave as it does today, in writing, first. APM stays.
The letters mark where each verb acts in the drawing with the Blueprint.
Already open, now owned
Because collection already runs on OpenTelemetry, moving the ordinary tier is a configuration and routing change, not a re-instrumentation project.
We inventory the estate by what each host actually uses: which apps need APM, which hosts only report infrastructure metrics. The collectors on the ordinary tier are brought under a console you own, configured from your repository, and pointed at a store you own. Each alert is rebuilt and proven before any host leaves the meter.
What you own after: the collector configuration, the ordinary tier’s alerts and dashboards as code, a Lake that holds the history, and a Splunk contract scoped to the apps that need it.
04The free architecture review
We draw your Splunk Observability estate, free.
Telemetry engineers look at your whole environment and show you exactly where the cost, the waste and the hurdles are, and what your architecture could look like. No strings attached.
What you get
- Your Splunk Observability architecture today, drawnEvery source, pipeline and destination, as it actually flows.
- The waste mapWhere you pay for data nobody reads, and what it costs you each year.
- Costs before and after, with estimatesWhat you spend now, and what the same coverage would cost.
- Your target architectureWhat your Splunk Observability estate could look like, drawn on your own sources.
- Options for your business problemNot one product. The choices, with what each one costs and changes.
Who does it
A lead architect with 26 years in monitoring and observability, leading a team of senior engineers in telemetry engineering and pipeline design. The team that reviews it is the team that would build it.
What it takes from you
Your diagrams and one call. No system access.
What comes next
If it pays, a two-week proof of value on your noisiest source, free unless you go ahead. At least 20% less into your SIEM, every alert kept, proved on your data.
What it costs
Nothing
No strings attached. You keep the drawing, whatever you decide.
05Questions
What Splunk Observability teams ask before they book
Do you replace Splunk Observability Cloud?
No, not the part that earns its tier. APM stays on the apps that need full-fidelity tracing. The honest replacement case is ordinary infrastructure hosts on basic checks, which move to a store you own with each alert proven first.
We already run OpenTelemetry. Do we re-instrument anything?
No. The collectors you run are the open standard. What changes is who configures them and where they send: the configuration moves into your repository, and each signal goes where it earns its place.
Why not New Relic or another vendor for the ordinary tier?
You can, and the choice stays yours. For ordinary hosts on basic checks, a store you own removes the per-host meter entirely, and the same collectors can feed any vendor later.
Why is the review free?
Because the drawing is how you judge us. You see your own architecture, your waste and your options before you spend anything, and you keep the drawing whatever you decide. No system access, no obligation.
Are you a reseller for a vendor?
Yes, for certain vendors’ software. We are also the delivery partner and integrator on custom projects, directly or alongside your systems integrator. The pipeline subscription is in your name, bought from the vendor, its channel or through Logmetry where we resell it, and priced on its own line. We recommend what fits your business problem, even when that means changing nothing, and no SIEM or APM vendor pays us to recommend it.
What if the savings don’t hold on our data?
You see it measured before you commit. The two-week proof of value runs on your noisiest source, with success criteria signed before it starts, measured in your SIEM’s own license usage view. At least 20% less into your SIEM, every alert kept, proved on your data.
See your Splunk Observability estate drawn, with the costs, before you spend anything
Run by a lead architect with 26 years in monitoring and observability. No system access, no charge, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing