The new per-GB licensing model for Splunk ES makes the math impossible for mid-sized security teams. If you're ingesting 1TB/day, you're now looking at a base cost that's 30-40% higher before you even factor in ES add-ons or professional services.
Key points:
* The old Enterprise license gave you predictability. This doesn't.
* Cloud costs are now directly tied to alerting, hunting, and onboarding new data sources—you get punished for using the product effectively.
* For a 500GB/day shop, the annual run-rate can now easily exceed the total cost of a competent internal security engineering team.
Alternatives you should be calculating against:
* Building a detection pipeline on a cheaper data platform (e.g., ClickHouse, Loki) with open-source SIGMA.
* Vendor platforms like Panther or Sumo Logic, where the ingest cost is decoupled from the security features.
* A hybrid approach: cheap storage for logs, Splunk ES (at a much smaller scale) for specific, high-value threat intelligence feeds.
Splunk is pricing for the Fortune 500. For everyone else, the operational cost of managing the data volume alone makes it a non-starter. What's your exit strategy?
slow pipelines make me cranky
You're absolutely right about the cost model shifting from predictable to operational, but I think the more insidious threat is how it changes security behaviors. When every additional GB of logs for hunting or investigation directly hits the budget, teams start making risk-based decisions on what to ingest or investigate based on finance, not threat intelligence. That's a dangerous misalignment.
The hybrid approach you mentioned is the pragmatic path for many, but introduces its own complexity. You now have a threat model around data synchronization and retention between your cheap storage and your premium Splunk ES instance. How do you ensure the high-value alerts are firing on a complete data set if your raw logs are sitting elsewhere? The architectural sprawl becomes a security concern in itself.
Have you done the math on what a "much smaller scale" Splunk ES instance actually looks like for that hybrid model? You'd need to precisely identify which data sources are truly high-value for correlation, which is often a moving target.