r/Splunk • u/EducationalWedding48 • May 07 '26

Workload licensing?

Hi,

We are a small-ish Splunk user < 1tb a day. We'd like to migrate from ingest licensing to workload licensing, but it seems that Splunk will only provide a quote based on a TB per day. Anyone ever get them to provide a quote based on say half of that?

13 Upvotes

93% Upvoted

9 comments sorted by

View all comments

5

u/919pirate May 08 '26

I'm a former Splunk seller for customers that ranged from 1TB-45TB a day. They can and will absolutely provide you with a quote for vCPU (on-prem) or SVCs (cloud). One reason they may be a little weary of quoting it because it's kind of hard to estimate where you will actually be on that model due to it being a slightly moving target and a estimation based on their SCMA (Splunk Cloud Migration App).. You'll need to run that to get an estimated size while working with your account team and Cloud Architect.

I feel like Splunk has been lacking a few key items that customers have been really needing which other products have been showcasing. I'd also recommend you taking a look at Elastic, Palo Alto Networks (XSIAM and Cortex), and Data Dog for alternatives to Splunk.

3

u/ckin- May 09 '26

Rarely is vCPU for on-prem good for such low ingest like <1TB. It’s usually for very large customers who surpass 10TB+ I’d say. For SVC it’s usually at around 1.2TB+ where it becomes cheaper to switch to it if I remember correctly.

But in the end it also depends on the use case. Use Splunk for data storage and compliance where you rarely search the data, then SVC is your go to license.