Obseria vs Splunk

Feature comparison

Obseria as a Splunk alternative: the short answer

When people search for a Splunk alternative for observability, they usually mean Splunk Observability Cloud, the SaaS suite for infrastructure monitoring, APM, real user monitoring and synthetics, often combined with Splunk Cloud Platform or Splunk Enterprise for logs. Splunk is part of Cisco. Obseria covers the same observability use cases, but it stores every signal in one lakehouse and bills only for data volume. This comparison is based on Splunk's public pricing pages and documentation as of October 2026 and focuses on Splunk Observability Cloud, not on Splunk's SIEM offerings.

Pricing model: host-based editions vs. per signal

According to its pricing page, Splunk Observability Cloud uses host-based entity pricing, billed annually, in three editions. The Infrastructure edition includes infrastructure monitoring, Log Observer Connect, network monitoring and synthetic uptime checks. App & Infra adds APM with always-on profiling and synthetic API monitoring. End-to-End adds real user monitoring and synthetic browser monitoring. Add-ons such as database monitoring and application security are priced through sales. Log storage itself is licensed through the Splunk platform rather than through Observability Cloud.

Host-based editions make budgeting straightforward when the host count is stable, and they include generous telemetry per host. The trade-off appears in containerized and serverless environments where the notion of a host is fluid, and in organizations where observability and log costs sit in two different contracts.

Obseria uses a single usage-based model:

• Logs, spans and RUM web events: $0.060 per million ingested, $0.540 per million stored, 30-day retention.
• Metric data points: $0.020 per million ingested, $0.180 per million stored, 13-month retention.
• Synthetic API check runs: $0.20 per thousand. Intelligence agent credits: $0.60 each.
• No host or seat fees, unlimited users, and every feature included. Data filtered in Obseria Pipeline only costs ingestion.

Data model: logs, metrics and traces

Splunk Observability Cloud grew out of a streaming metrics engine, queried with SignalFlow, that is designed for real-time charts and detectors at high resolution. For logs, Log Observer Connect queries data that stays in Splunk Cloud Platform or Splunk Enterprise, where it is searched with SPL. For organizations that already run Splunk for security and operations, this avoids duplicating logs.

Obseria stores logs, metrics, spans, profiles, RUM events and security signals together in Obseria Lake, an index-free lakehouse with schema-on-read and field-level privacy. One query can join a latency spike in metrics with the matching spans and log lines, without moving between products:

fetch logs
| filter service == "payments"
| summarize count(), by:{level}

Besides OQL, Obseria supports PromQL and SQL. Teams that rely heavily on SPL will need to translate saved searches; teams that mainly use the observability UI usually find the move simpler.

Tracing and OpenTelemetry

Splunk is an active contributor to OpenTelemetry, and Splunk Observability Cloud is built around it: data is collected with the Splunk Distribution of the OpenTelemetry Collector and Splunk's OpenTelemetry language distributions. Splunk APM offers full-fidelity tracing, which Splunk calls NoSample: all spans are ingested and analyzed rather than sampled, so no individual trace is lost.

Obseria is also OpenTelemetry-native. You can send OTLP from any upstream SDK or Collector, export data via OTLP at any time, and see a first trace within about 15 minutes with existing SDKs. Instead of storing every span, Obseria uses tail-based sampling to keep errors, slow requests and other relevant traces while controlling volume and cost. Continuous profiling runs at under 1% overhead, and the Obseria Agent, installed once per host, adds host metrics, logs, profiles and security signals.

The choice here is a real trade-off: full-fidelity tracing maximizes completeness, while tail-based sampling optimizes cost for high-throughput services.

AI and root-cause analysis

Splunk Observability Cloud provides AI-assisted troubleshooting and anomaly detection on top of its streaming analytics, and Cisco has been integrating AI assistants across the Splunk portfolio.

Obseria Intelligence combines causal, predictive and generative AI on top of Obseria TopoGraph, the automatically built topology of apps and infrastructure. Agentic root-cause investigations return a chain of evidence that engineers can verify. Agent credits cost $0.60 each, and customer data is never used for AI training.

Data residency and compliance

Splunk Observability Cloud runs in regional deployments called realms, including realms in Europe; the realm is fixed for an organization. Splunk lists its certifications on its trust pages.

Obseria stores data in the EU (Frankfurt, Dublin), the UK (London) or your own cloud account (BYOC), and is certified to ISO 27001, 27017 and 27018, SOC 2 Type II, BSI C5 for the EU region and TISAX. It supports DORA, NIS2 and GDPR with automatic PII masking, field-level access, audit logs and a 99.95% SLA.

Migrating from Splunk Observability Cloud

Because both platforms build on OpenTelemetry, migration usually starts in the Collector: add an OTLP exporter for Obseria next to the Splunk exporter and send data to both. Then rebuild the detectors and dashboards your on-call teams use, translating SignalFlow and SPL logic into OQL, PromQL or SQL. Finally, decide which logs should move to Obseria Lake and which should stay in your Splunk platform for security use cases. The 14-day free trial requires no credit card.

A hybrid setup is a legitimate end state, not only a transition. Obseria Pipeline can filter, mask and route data at ingest, so security-relevant events can continue to flow to Splunk while application and infrastructure telemetry lands in Obseria Lake. Compare the combined cost of both contracts against a single per-signal bill using your real data volumes before you decide how far to move.

Which tool fits you?

Switching in three steps

1. Dual-export from the Collector. Add an Obseria OTLP exporter next to the Splunk exporter in your OpenTelemetry Collector configuration.
2. Rebuild detectors and dashboards. Translate SignalFlow detectors and SPL searches used by on-call teams into OQL, PromQL or SQL.
3. Decide where logs live. Move observability logs to Obseria Lake and keep security-relevant logs in Splunk where needed.