In 2018, two things happened in incident management that look different with hindsight. Splunk agreed to buy VictorOps for about $120 million and renamed it Splunk On-Call. And in New York, Robert Ross and Dylan Nielsen founded FireHydrant. Eight years later, FireHydrant has been bought too, by Freshworks in January 2026, and Splunk itself now belongs to Cisco.
That shared arc is the most useful way to read this comparison. Splunk On-Call shows what an incident tool can look like several years after an acquisition: still reliable, still cheap, and no longer the place where its owner invests. FireHydrant is nine months into its own acquisition, with a parent that has promised continuity and a product that is still adding features.
The products also do different jobs. Splunk On-Call is a mature paging tool, built around a rules engine that shapes alerts and routes them through schedules to a mobile app reviewers still praise. FireHydrant starts where Splunk On-Call stops. FireHydrant is a response platform that runs the incident after the page, with condition-triggered runbooks, Slack and Teams channels, a service catalog, change tracking, status pages, and retrospectives, plus its own on-call product.
This comparison covers where each product stands, alerting and on-call, the response after acknowledgment, retrospectives and status pages, AI, and pricing for a 25-person team, then looks at what a move from one to the other involves.
The table covers what teams usually ask first. The status row matters as much as any feature row.
| Category | FireHydrant | Splunk On-Call |
|---|---|---|
| Origin | Founded 2018, New York | VictorOps, founded 2012, acquired by Splunk in 2018 |
| Owner today | Freshworks | Cisco, through Splunk |
| Development | Active | Maintenance mode, according to analysts and reviewers |
| Core job | Running the incident | Paging the right person |
| Alert shaping | Alert rules in Signals | ✔, rules engine with transforms and annotations |
| Responder suggestions | Service catalog ownership | ✔, machine learning |
| Incident channels in Slack or Teams | ✔, core design | Slack integration |
| Runbooks | ✔, automated process steps | Runbook links attached to alerts |
| Service catalog | ✔, Pro | ✘ |
| Status pages | ✔, unlimited public on Pro | ✘ |
| Retrospectives | ✔, timeline-based | Post-incident reviews |
| AI | Summaries, transcripts, and retros on Enterprise | ✘ |
| MCP server | ✔, open source | ✘ |
| Free plan | Up to 10 responders | ✘ |
| List price | $25 per responder per month | From $5 per user per month for up to 10 users |
| Logs, metrics, traces | ✘ | ✘, separate Splunk Observability Cloud |
Before features, look at the direction each product is heading.
Splunk On-Call still does what VictorOps did. It takes alerts from Splunk products and hundreds of other tools, shapes them in a rules engine, routes them through schedules and escalation policies, and wakes people up through a mobile app. There is no end-of-life notice, and the service runs normally.
The investment behind it has changed. After Cisco closed its roughly $28 billion purchase of Splunk in 2024, Constellation Research reported that Splunk had wound down the VictorOps product and strategy teams and left engineering and support to maintain it. Reviews in 2026 describe a product that looks much as it did years ago. Splunk's newer incident work goes into Incident Intelligence inside Splunk Observability Cloud and into its AI assistant tools. If you are already weighing a move, our roundup of Splunk On-Call alternatives covers the wider field.
Freshworks closed its FireHydrant deal on January 5, 2026, and placed it inside the Freshservice portfolio. FireHydrant told customers that accounts, pricing, and support would stay the same, and so far the visible changes are additions, such as two-way sync with Freshservice tickets and an MCP server now published under Freshworks' GitHub organization. Freshworks describes the long-term goal as one platform for IT service management, infrastructure management, and incident response.
Nobody can promise how FireHydrant's roadmap will look in five years. What you can say today is that it is still being developed as a product, while Splunk On-Call is being maintained as one.
| Product status | FireHydrant | Splunk On-Call |
|---|---|---|
| Years since acquisition | Under one | About eight |
| Active feature development | ✔ | ✘, maintenance |
| Where the owner invests in incidents | This product and Freshservice | Splunk Observability Cloud and AI tools |
| End-of-life notice | ✘ | ✘, none announced |
Splunk On-Call's strongest feature is what it does to an alert before anyone sees it.
Every alert reaches Splunk On-Call with a routing key that maps it to a team. The rules engine can transform fields, annotate the alert with runbook links, dashboards, and notes, change its routing, and suppress it, so the person paged arrives with context. Machine learning suggests responders who handled similar incidents.
Years of accumulated rules are both the strength and the risk. A well-tended rules engine makes every page useful. A neglected one carries routing nobody remembers writing.
FireHydrant's Signals takes alerts through webhooks and integrations and applies alert rules that decide who is paged and which escalation policy runs. Pro includes unlimited alert rules, webhooks, and escalation policies, while alert grouping and notification policies are Enterprise features.
Signals is designed to hand the alert straight into an incident, where FireHydrant's runbooks and catalog take over. It does less shaping of the alert itself and more with what happens next.
| Alerting | FireHydrant | Splunk On-Call |
|---|---|---|
| Routing model | Alert rules and escalation policies | Routing keys and escalation policies |
| Alert transforms and annotations | Limited | ✔ |
| Runbook links on the alert | Runbooks run on the incident | ✔, via annotations |
| Responder suggestions | Catalog ownership | ✔, machine learning |
| Alert grouping | Enterprise | Via rules |
| Integrations | 3 on Free, 5 on Pro, unlimited on Enterprise | Hundreds, plus Splunk products |
Splunk On-Call reshapes alerts that another tool sends, and FireHydrant routes them into an incident, so both depend on routing keys or webhooks staying correct. Better Stack collects logs, metrics, and traces from your services and alerts on that data directly, so detection, routing, and the evidence behind the page live in one platform.
There is less to misroute when the tool that pages you also produced the alert. See Better Stack incident management.
Both cover rotations, overrides, and escalation tiers. The differences are in polish, pricing, and the phone in your pocket.
Splunk On-Call's scheduling has been refined since 2012. Rotations, overrides, and multi-step escalation policies work as you would expect, and the mobile app is the feature former users miss most after they leave, especially for acknowledging and rerouting from a lock screen. On-call is the product, so it is included in the seat price.
FireHydrant's Signals schedules are newer. They cover rotations and unlimited escalation policies, with notifications by push, Slack, Teams, and email. SMS and voice are sold separately, Signals is charged by alert volume, and live call routing is an Enterprise feature.
| On-call | FireHydrant | Splunk On-Call |
|---|---|---|
| Rotations and overrides | ✔ | ✔ |
| Multi-step escalation | ✔, unlimited policies | ✔ |
| Mobile app | ✔ | ✔, a long-standing strength |
| SMS and voice | Sold separately | Included |
| Live call routing | Enterprise | Limited |
| Billing | Per responder plus alert volume | Per user |
This is where the products separate most. Splunk On-Call's job is largely done once the right person acknowledges. FireHydrant's job starts there.
When an incident is declared, FireHydrant runs the runbooks whose conditions match. A SEV1 on the checkout service can open a Slack or Teams channel, start a video bridge, page the owning team, assign an incident commander, open a ticket, and post a status update before anyone types a command.
The service catalog tells the incident who owns the affected service and what it depends on, and FireHydrant ingests deploy and infrastructure change events so responders can see what shipped just before the failure.
Pro caps runbooks at 5, so larger teams with many incident types tend to need Enterprise.
Splunk On-Call gives each incident a timeline and audit trail, lets responders from several teams collaborate on it, and syncs tickets with ServiceNow and other ITSM tools in both directions. That covers the record of the incident well. The coordination itself, the channel, the bridge, the notes, usually happens in Slack, Zoom, and a shared doc outside the tool.
| After acknowledgment | FireHydrant | Splunk On-Call |
|---|---|---|
| Automatic incident channel | ✔ | ✘ |
| Video bridge creation | ✔ | ✘ |
| Process automation | ✔, runbooks | ✘ |
| Service ownership and dependencies | ✔, catalog | Routing keys |
| Change event tracking | ✔ | ✘ |
| Timeline and audit trail | ✔ | ✔ |
| ITSM sync | Freshservice, ServiceNow, Jira | ServiceNow and others, bidirectional |
Splunk On-Call leaves coordination to Slack and a shared doc, and FireHydrant automates the channel but still links out to another tool for the evidence. Better Stack opens the incident channel in Slack or Teams with the triggering logs and metrics already attached, so responders can acknowledge, escalate, and investigate in one thread.
The channel is more useful when it opens with the error, not just the alert name. Explore Slack-based incident management.
FireHydrant includes most of what Splunk On-Call leaves out here.
FireHydrant builds retrospectives from its incident timeline, with one template on Pro and unlimited templates plus AI drafts on Enterprise. Incident analytics are Enterprise-only.
Status pages are the clearest gap. FireHydrant's Free plan includes 1 public page and Pro includes unlimited public pages, updated by runbooks. Splunk On-Call has no status pages, so most of its customers pay for a separate product.
Splunk On-Call supports post-incident reviews and reports on incident frequency, MTTA, and MTTR, and those reports have changed little in years.
| Learning and communication | FireHydrant | Splunk On-Call |
|---|---|---|
| Retrospectives | ✔, from the timeline | Post-incident reviews |
| AI retrospective drafts | Enterprise | ✘ |
| MTTA and MTTR reporting | Enterprise analytics | ✔ |
| Public status pages | 1 on Free, unlimited on Pro | ✘ |
| Private status pages | Enterprise | ✘ |
Splunk On-Call reports MTTA and MTTR, and FireHydrant keeps analytics for Enterprise, but neither can chart what the system was doing during those incidents. Better Stack lets you drag incident history, error rates, and latency onto one dashboard, so a slow response and the failure behind it show up on the same chart.
A retrospective lands harder when the response times and the error spike share an axis. Build a Better Stack dashboard.
Splunk On-Call has not gained modern AI features. Its intelligence is the machine learning that suggests responders and links similar past incidents.
FireHydrant AI writes summaries into the incident timeline, transcribes calls, helps triage, drafts retrospectives, and suggests follow-ups, but all of it sits on the Enterprise plan. On Pro you get no AI features. FireHydrant also ships an open-source MCP server that runs locally with an API key, so assistants like Claude can read and act on incidents. Splunk On-Call has no MCP server.
| AI and MCP | FireHydrant | Splunk On-Call |
|---|---|---|
| Responder suggestions | Catalog ownership | ✔, machine learning |
| Incident summaries | Enterprise | ✘ |
| Call transcription | Enterprise | ✘ |
| AI retrospective drafts | Enterprise | ✘ |
| Root-cause investigation | ✘ | ✘ |
| MCP server | ✔, open source, local | ✘ |
Neither FireHydrant nor Splunk On-Call collects logs, stores metrics, records traces, or runs uptime checks. Splunk sells a full observability suite, but Splunk Observability Cloud is a separate product with its own host-based pricing, and the incident features most tightly tied to it live in Incident Intelligence rather than standalone On-Call.
So whichever you choose, responders keep switching to a monitoring tool to find the log line or slow request behind the page, and every integration between that tool and your pager is one more thing to keep working.
| Observability | FireHydrant | Splunk On-Call |
|---|---|---|
| Log management | ✘ | ✘, separate Splunk product |
| Metrics | ✘ | ✘, separate Splunk product |
| Distributed tracing | ✘ | ✘, separate Splunk product |
| Uptime monitoring | ✘ | ✘ |
| Where investigation data lives | Connected integrations | Connected integrations |
Moving off Splunk On-Call means rewiring alert integrations anyway, and FireHydrant would still leave your telemetry in a separate product. Better Stack ingests logs from the pipelines you already run, including Vector and OpenTelemetry, and runs on-call, incidents, and status pages on top of the same data.
If you are rewiring your alerts, point the telemetry at the same place. See Better Stack log management.
Splunk On-Call is the cheaper tool on paper. The question is what you add around it.
Splunk lists On-Call at $5 per user per month for up to 10 users, billed annually, and larger deployments are quoted by sales. There is no free plan. Older third-party listings show tiers between $10 and $45 per user per month, so confirm the price you will actually pay before you budget.
Assume 25 engineers, 10 of whom carry the pager, billed annually. Splunk's list price covers only the first 10 users, so its figure is an estimate. Monitoring is excluded for both.
| Cost component | FireHydrant Pro | Splunk On-Call |
|---|---|---|
| If all 25 respond | 25 at $25, so $625 per month | Around $125 at the $5 rate, sales quote likely |
| If only the 10 on call respond | 10 at $25, so $250 per month | 10 at $5, so $50 per month |
| SMS and voice | Extra | Included |
| Status pages | Included | Separate product |
| Runbooks and catalog | Included | ✘ |
| AI | Requires Enterprise | ✘ |
Splunk On-Call is far cheaper if paging is all you want. FireHydrant costs several hundred dollars more a month for this team, and in exchange replaces the status page tool, the shared incident doc, and much of the manual coordination around the pager. A team of up to 10 responders can try FireHydrant's free plan before committing.
If you decide to switch, on-call is the part that cannot break.
Stay on Splunk On-Call if paging is the whole job and cost matters most. It is cheap, dependable, and familiar, and a team that already runs incidents in Slack and a shared doc gives up little by renewing. Revisit the decision each year, because the product is being maintained rather than expanded.
Choose FireHydrant if your incidents have grown past one person and a pager, and you want every response to follow the same steps. Its runbooks, service catalog, change tracking, status pages, and retrospectives cover the work Splunk On-Call leaves to other tools. Plan for Enterprise if you want the AI or analytics, and budget for phone alerts. If FireHydrant is not quite right either, our list of FireHydrant alternatives covers the next options.
These two tools sit at opposite ends of the same story. Splunk On-Call is what a well-built pager looks like when its owner stops investing in it, and FireHydrant is a broader product whose new owner is still investing.
That makes the real decision about time, not features. If you only need dependable pages through your next renewal, Splunk On-Call will deliver them for very little. If you expect your incident process to keep growing, buy the tool that is still growing with it, and ask Freshworks the same roadmap questions now that Splunk customers wish they had asked in 2018.
FireHydrant's MCP server exposes incident data, and Splunk On-Call has no MCP server at all, but neither can give an AI assistant your logs or traces, because neither stores them. Better Stack's MCP server covers the whole platform, so Claude or Cursor can query your logs with SQL, check who is on call, acknowledge an incident, and build a dashboard chart in one conversation.
With incidents and telemetry behind one MCP endpoint, your assistant can investigate and respond without switching tools. Try Better Stack.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
FireHydrant is great for incident management, but it's not perfect. Check out these FireHydrant alternatives and find the right fit for you.
FireHydrant vs Rootly compared for 2026: runbooks versus workflows, where each vendor gates its AI, Signals versus Rootly On-Call, MCP servers, Freshworks ownership, and per-responder versus per-user pricing.
On-Call is a comprehensive, innovative, and feature-rich incident management solution. Splunk is a significant player in the market and offers solutions for a wide range of functions. However, all this comes for a price.
We use cookies to authenticate users, improve the product user experience, and for personalized ads. Learn more.