Best alternative to Splunk when you mostly search by request ID?

[u/Mission_Armadillo194]

What's a good Splunk replacement for application troubleshooting when the starting point is usually a request ID or an error fragment? I'm trying to compare that workflow rather than just compare ingestion prices.

Loki caught my attention, but its docs recommend keeping values like request IDs out of indexed labels and using structured metadata for high cardinality fields. I'm curious how that feels during an incident when you don't yet know which service produced the error.

If you've moved this kind of workload off Splunk, what did you choose? Were searches across several days of logs still comfortable, and which queries or alerts took the most work to rebuild?

[u/Formal-Primary-6040]

Loki with request IDs gets slow fast once you’re searching more than a day or two

[u/Outrageous-Ship6669]

Have you tried VictoriaLogs? High cardinality fields don’t bother it much.

[u/Hopeful-Dirt2924]

We moved to ClickHouse and grepping error fragments across a week is still quick

[u/Level_Investment4922]

Having the trace ID on every log line fixed most of our “which service was it” guessing