Splunk vs Datadog Cloud SIEM cost: 2026 comparison
Independent head-to-head cost comparison. Per-GB Splunk versus per-host-plus-per-GB Datadog at five host-and-volume profiles, five-year TCO, and where each vendor wins on consolidation versus depth. Updated May 2026.
Per-GB versus per-host: how the meters collide
Splunk and Datadog price on different axes, which makes the comparison structurally interesting. Splunk meters per gigabyte ingested, with a separate Enterprise Security licence covering SIEM analytics and content. Datadog meters per host (Infrastructure base) plus per-GB-ingested (Logs) plus per-analyzed-GB (Cloud SIEM) plus per-million-events (indexing tier). The meter mismatch means the comparison flips between Splunk-favoured and Datadog-favoured depending on the host-to-log-volume ratio of the specific environment.
For environments where logs originate primarily from hosts already paying for Datadog Infrastructure (engineering organisations, SaaS companies, cloud-native startups), the marginal Datadog Cloud SIEM cost is genuinely small and the consolidation argument compounds across the platform. For environments where logs originate from network appliances, SaaS audit logs, or external sources without corresponding Datadog hosts, the Datadog comparison loses its structural advantage and Splunk's per-GB economics win cleanly. The 50-host / 50-GB profile favours Datadog by roughly 30 percent; the 500-host / 50-GB profile inverts and favours Splunk by similar margin.
Detection content depth is the second axis where Splunk maintains structural advantage. Splunk Enterprise Security plus the broader content ecosystem (premium content packs, ITSI integration, community apps, mature SOAR add-on) deliver investigation depth that Datadog Cloud SIEM does not yet match. For mature SOCs where this depth is the binding constraint, the licence cost comparison is secondary. For SOCs whose detection content is broadly portable or built de novo, the licence savings can drive the migration.
Same environment, both vendors
| Profile | Splunk Cloud + ES | Datadog all-in | Winner | Note |
|---|---|---|---|---|
| 50 hosts, 25 GB/day | $80K | $58K | Datadog | Datadog wins on combined platform if hosts already paid |
| 100 hosts, 50 GB/day | $175K (with ES) | $120K-$160K | Datadog | Cloud SIEM line tiny; indexed-log line dominates Datadog bill |
| 200 hosts, 50 GB/day | $175K (with ES) | $155K-$200K | Even | Datadog per-host base eats the lead at higher host counts |
| 500 hosts, 100 GB/day | $340K (with ES) | $385K-$520K | Splunk | Datadog per-host base inverts the unit-economics argument |
| 200 hosts, 250 GB/day | $680K (with ES) | $650K-$820K | Even | Both vendors badly priced at this profile; Sentinel preferred |
Annual licence ranges, list pricing for both vendors, before negotiated multi-year discounts. Datadog all-in includes per-host base, indexed log retention, and Cloud SIEM line.
Five-year TCO at 100 hosts and 50 GB per day
| Year | Splunk Cloud + ES | Datadog |
|---|---|---|
| Year 1 (100 hosts, 50 GB/day) | $280K | $140K (consolidation case) |
| Year 2 | $210K (TCO drop) | $135K (steady state) |
| Year 3 | $200K (steady state) | $135K |
| Year 4 | $210K (5% inflation) | $140K (5% inflation) |
| Year 5 | $220K | $145K |
| 5-year total | $1.12M | $695K |
Five-year cumulative includes initial licence, 5% inflation per year, and Year 2 TCO compression on Splunk. Excludes one-time migration costs.
When Splunk genuinely wins
- +Mature SOCs with deep custom Splunk ES content where the depth and search performance are the binding constraint, not consolidation
- +Environments with high-host / low-log-volume ratios where Datadog's per-host base inverts the unit-economics argument
- +Detection content libraries (premium content packs, ITSI, SOAR) that Datadog Cloud SIEM does not match
- +Compliance-driven retention where Splunk Cloud's archive tier with searchable cold storage beats Datadog Flex Logs query latency
- +Existing Splunk-trained SOC analysts where retraining on Datadog SIEM workflow delivers productivity tax that licence saving cannot recover
When Datadog genuinely wins
- +Existing Datadog APM and Infrastructure customers where the marginal Cloud SIEM line is genuinely small (typically $3K-$18K per year)
- +Engineering-led security teams who value API-first detection workflow and code-driven detection management
- +Cloud-native environments where application telemetry (Datadog APM, traces, RUM) is the primary detection input, not network and endpoint correlation
- +Organisations consolidating monitoring and security on a single platform where the operational simplification of one vendor matters
- +Cost-driven Splunk migrations at moderate scale where Datadog Flex Logs absorbs long-retention compliance volume cheaply