CrowdStrike Falcon LogScale (Humio) pricing in 2026: indexing-free per-GB

CrowdStrike Falcon LogScale (formerly Humio, acquired in 2022) prices on a per-GB ingested meter without the indexing surcharges that define Splunk Enterprise pricing. The architectural decision that produces this pricing model is the indexing-free design: LogScale's data plane uses an inverted-index-free schema-on-read approach that eliminates the index-build cost that Splunk amortises into its per-GB rate. The practical effect is that the LogScale headline list ($0.55-$1.10 per GB) genuinely covers ingest, storage, and query, where the Splunk equivalent typically requires adding indexing tier costs that double or triple the headline.

Retention is bundled at the tier level rather than billed separately. Standard tiers include 30-90 day retention by default; longer-retention contracts are quoted as part of the initial deal rather than upgraded mid-term. The bundling simplifies budget forecasting and removes the per-GB-per-month archive-tier line item that complicates Splunk Cloud, Datadog, and Sumo Logic pricing comparisons. For compliance-driven customers, retention should be negotiated as part of the initial commit rather than added later: mid-term retention extensions land at list pricing.

The bundling with the broader Falcon platform is the second structural pricing dynamic. Falcon Next-Gen SIEM combines LogScale (data plane) with the existing Falcon Insight XDR (detection, response, investigation) and the Falcon agent (already deployed in any Falcon EDR customer environment). For existing Falcon EDR/XDR customers, the marginal cost of adding LogScale via Next-Gen SIEM is typically 20-30 percent below standalone LogScale plus standalone Falcon Insight, and the operational simplification (single agent, single console, single threat intelligence pipeline) is genuine.

The largest cost-discipline lever remains source-side filtering. LogScale's parser framework supports drop rules that prevent low-value events from counting against the per-GB meter at all. Aggressive use of drop rules on debug logs, routine NetFlow, verbose Windows event spam (Service Control Manager noise, routine logon successes), and similar low-fidelity sources typically removes 20-30 percent of metered ingest without affecting detection coverage. Customers who do not invest in source-side filtering pay for log volume that yields no security signal.

EA discounting at multi-year commits above $250K committed annual spend produces 25-30 percent off list as a routine outcome. Quarter-end pressure (particularly Q4 and end of CrowdStrike's fiscal year) carries the deepest discount band. Single-year transactional commits at scale leave value on the table; the discount math materially favours multi-year buyers.

The 2026 competitive position for LogScale is unusually strong. CrowdStrike's broader Falcon platform momentum is producing favourable bundling math against Splunk-plus-Microsoft-Defender or Sentinel-plus-Defender consolidation pitches, and the indexing-free per-GB rate is genuinely structural rather than promotional. For organisations evaluating Splunk consolidation in 2026, LogScale plus Falcon Next-Gen SIEM is the realistic alternative shortlist with Sentinel and Sumo Logic.

LogScale wins decisively for existing CrowdStrike Falcon EDR/XDR customers who are evaluating SIEM consolidation. The bundle math via Falcon Next-Gen SIEM is genuinely favourable, the operational simplification of single-agent / single-console is real, and the indexing-free per-GB rate eliminates the Splunk indexing premium that has driven so much 2024-2026 SIEM displacement. For organisations already on Falcon, evaluating any other SIEM in 2026 without including LogScale in the shortlist is leaving the bundle math on the table.

LogScale also wins for high-volume log analytics use cases where the indexing-free architecture's structural cost advantage compounds: organisations ingesting 500 GB-plus per day where Splunk indexing surcharges have driven the bill into multi-million-dollar territory routinely halve their SIEM TCO by migrating to LogScale, particularly when the migration is bundled with Falcon EDR/XDR consolidation.

LogScale is the wrong pick for organisations whose detection content is built around Splunk Enterprise Security depth, where the content library and search performance are the binding constraints rather than raw log analytics cost. It is also wrong for Microsoft-heavy shops whose log mix is dominated by Microsoft 365 and Azure sources, where Sentinel's bundled Microsoft ingest is structurally cheaper. And it is wrong for organisations not on the Falcon platform whose marginal cost of evaluation includes the broader Falcon agent rollout, which is a meaningful operational lift even when the SIEM economics are favourable.