Splunk built its name on logs, so it surprises many buyers that Splunk Observability Cloud does not store them. Observability Cloud, which grew out of the SignalFx acquisition in 2019, handles metrics, traces, real user monitoring, and synthetics. Logs live in a different product, Splunk Cloud Platform, with different pricing, and Observability Cloud reaches them through a bridge called Log Observer Connect. If you do not already run Splunk Cloud Platform, adopting Observability Cloud means deciding where your logs will go.
Grafana Cloud keeps logs, metrics, traces, and profiles under one account and one bill, even though each signal has its own backend. That difference matters less to teams that already pay for Splunk's log platform and much more to teams starting fresh, and it is the clearest way to see who each product is really built for.
Splunk Observability Cloud is a host-priced APM and infrastructure suite built on real-time streaming analytics, designed to sit alongside Splunk's log and security platforms inside Cisco. Grafana Cloud covers more of the stack in one product. Grafana Cloud is a usage-priced platform that keeps all four signals under one roof, plus the most flexible dashboards available, on-call, and AI.
This comparison covers architecture and logs, instrumentation, metrics and infrastructure, APM, digital experience, dashboards and querying, AI, alerting and on-call, pricing, and enterprise needs.
Here are the rows buyers usually start with. Several of them come back to whether you already own Splunk's log platform.
| Category | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| Owner | Grafana Labs | Cisco, through Splunk |
| Logs | ✔, Loki, same account | Separate Splunk Cloud Platform, via Log Observer Connect |
| Metrics | ✔, Mimir, Prometheus-native | ✔, streaming metrics from SignalFx |
| APM | ✔, Tempo and Application Observability | ✔, NoSample tracing |
| Continuous profiling | ✔, Pyroscope | ✔, AlwaysOn Profiling for Java, .NET, Node.js |
| RUM and synthetics | ✔ | ✔, End-to-End tier |
| Session replay | Check current plan | ✔ |
| Dashboards | ✔, industry-leading | ✔, built for streaming charts |
| Query languages | PromQL, LogQL, TraceQL | SignalFlow for metrics, SPL for logs in Splunk Platform |
| AI | Grafana Assistant and Sift | AI Assistant and troubleshooting features |
| On-call | ✔, Grafana IRM | Splunk On-Call, separate product |
| Free tier | 10,000 series, 50 GB per signal, 3 users | Up to 15 hosts |
| Pricing unit | Series, GB, and users | Per host, with sessions and runs for RUM and synthetics |
| Self-hosting | ✔, open-source stack | ✘ |
Grafana Cloud runs four backends under one account. Each signal lands in its own store, and Grafana's dashboards and Explore view read across all four. Everything shows up on one invoice, and a trace links to its logs through shared labels.
Splunk splits observability across products. Observability Cloud handles infrastructure, APM, RUM, and synthetics. Splunk Cloud Platform handles log search with SPL, priced separately by ingest or workload. Log Observer Connect lets Observability Cloud query logs that live in the Platform, so engineers can move from a trace to its logs, but the two products have different interfaces, billing, and administration. For organizations where a central team already runs Splunk Platform, this is a natural fit. For teams without it, logs become a second purchase.
| Architecture | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| Signals in one product | Metrics, logs, traces, profiles | Metrics, traces, RUM, synthetics |
| Log storage | Loki, included | Splunk Cloud Platform, separate |
| Trace-to-log navigation | Shared labels | Log Observer Connect |
| Bills | One | Observability Cloud plus Splunk Platform |
Splunk keeps logs in a separate product with separate pricing, and Grafana keeps them in a separate backend with its own query language. Better Stack puts logs, metrics, and traces in a single SQL-queryable warehouse, tails logs in real time, and charges $0.10 per GB ingested plus $0.05 per GB per month retained.
A trace is far more useful when its logs are one click away in the same product. See Better Stack log management.
Both lean on OpenTelemetry.
Splunk was an early OpenTelemetry backer, and Observability Cloud uses the Splunk Distribution of the OpenTelemetry Collector and language-specific OpenTelemetry instrumentation. Data is processed as it streams in, which is the basis for Splunk's fast charts and alerts.
On Grafana's side, Alloy gathers every signal type and understands both OpenTelemetry and Prometheus formats, so existing exporters keep working. Where code changes are off the table, Grafana's Beyla captures requests at the kernel level using eBPF.
| Instrumentation | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| Collector | Grafana Alloy | Splunk Distribution of the OpenTelemetry Collector |
| OpenTelemetry | ✔, native | ✔, native |
| Prometheus scraping | ✔, native | ✔, via collector |
| eBPF instrumentation | ✔, Beyla | Via OpenTelemetry options |
Splunk's SignalFx heritage gives it fast streaming metrics. Grafana's gives it the Prometheus ecosystem.
Splunk Infrastructure Monitoring processes metrics as they arrive and evaluates alerts in real time, so dashboards and detectors respond within seconds. SignalFlow, its streaming analytics language, drives charts and alert logic. It covers hosts, containers, Kubernetes, and cloud services, and AI Infrastructure Monitoring tracks GPU performance, LLM token costs, model latency, and vector databases. Custom metrics beyond each host's allowance count against your entitlement.
Grafana's Mimir accepts Prometheus remote write directly, stores Pro metrics for 13 months, and powers Kubernetes Monitoring and a large catalog of integrations. Most infrastructure engineers already read PromQL fluently, and the main thing to budget for is series count, billed at $6.50 per 1,000.
| Metrics and infrastructure | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| Processing | Store, then query | Streaming, in real time |
| Query language | PromQL | SignalFlow |
| Kubernetes monitoring | ✔, extensive | ✔ |
| AI and GPU infrastructure | Via integrations | ✔, AI Infrastructure Monitoring |
| Cost driver | Active series | Hosts, plus custom metrics over allowance |
Splunk prices metrics by host and caps custom metrics per host, and Grafana prices them by active series. Better Stack stores metrics by data volume, queries them with PromQL or SQL, and keeps searches fast at scale with Query Boost.
Your monitoring bill should follow your data, not the number of machines that produced it. See Better Stack metrics.
APM is a strength on both sides, though not the same strength.
Splunk APM keeps every trace across connected services with its NoSample approach and builds service maps, Tag Spotlight breakdowns, and error views from them. AlwaysOn Profiling adds continuous CPU and memory profiling for Java, .NET, and Node.js in production. Database Monitoring, priced per instance, adds query-level visibility.
Grafana stores traces in Tempo on object storage, so keeping large trace volumes is inexpensive, and TraceQL can filter on span structure and attributes. Application Observability turns OpenTelemetry data into service health views, and Pyroscope supplies continuous profiling across more languages than Splunk's AlwaysOn Profiling covers.
If you are comparing Splunk's APM with another enterprise option, our Dynatrace vs Splunk comparison covers that matchup.
| APM | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| Trace retention | Full or sampled, your choice | ✔, NoSample |
| Trace analytics | TraceQL | Tag Spotlight |
| Continuous profiling | ✔, Pyroscope, many languages | ✔, Java, .NET, Node.js |
| Database monitoring | Via integrations | ✔, per instance |
| Pricing | Per GB | $55 per host standalone, or in bundles |
Splunk's End-to-End tier includes real user monitoring, synthetics, and session replay. Its mobile SDKs cover iOS, Android, React Native, and Flutter, and Digital Experience Analytics, released in March 2026, combines user behavior with RUM and APM data. Standalone RUM costs $14 per 10,000 sessions and synthetics $1 per 10,000 runs.
Grafana's browser monitoring focuses on web vitals, JavaScript errors, and session timelines that link back to backend traces, and Grafana adds uptime checks plus k6 for load tests. Its mobile story is thinner than Splunk's.
| Digital experience | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| Browser RUM | ✔ | ✔ |
| Mobile SDKs | Web-focused | ✔, iOS, Android, React Native, Flutter |
| Session replay | Check current plan | ✔ |
| Synthetics | ✔ | ✔ |
| Load testing | ✔, k6 | ✘ |
Dashboards are Grafana's original product and still its standout. You can mix many sources on a single board, template everything with variables, and start from community dashboards, and Grafana even has a Splunk data source.
Splunk Observability Cloud's dashboards are built around streaming charts that update in near real time, and SignalFlow gives advanced users programmable analytics. Logs are queried with SPL in Splunk Platform, a powerful language with a long learning curve. Teams end up working in two query languages across two products.
| Dashboards and querying | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| Dashboard flexibility | Extensive | Streaming charts, less flexible |
| Outside data sources | Dozens, including Splunk | Mainly Splunk data |
| Metric queries | PromQL | SignalFlow |
| Log queries | LogQL | SPL in Splunk Platform |
Both have added AI to investigations.
Splunk offers an AI Assistant in Observability Cloud that answers questions about your environment in plain language and helps with troubleshooting, and it has been adding agentic troubleshooting features across the Splunk portfolio. Cisco also connects Splunk to its wider AI and networking products. Splunk publishes an MCP server for the Splunk Platform, and MCP access for Observability Cloud data should be confirmed with Splunk.
In Grafana, you ask Assistant to write a query, sketch a dashboard, or chase a problem, and Sift kicks off its own diagnostics whenever an incident begins. Grafana's MCP server, released as open source, gives external AI tools the same reach.
| AI and MCP | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| AI assistant | ✔, Grafana Assistant | ✔, AI Assistant |
| Automatic incident checks | ✔, Sift | Troubleshooting features |
| MCP server | ✔, open source | Splunk Platform, confirm for Observability Cloud |
| AI pricing | 3 Assistant users included | Confirm with Splunk |
Splunk's AI has to reach across Observability Cloud and Splunk Platform, and Grafana's spans several backends. Better Stack's AI SRE starts when an incident opens and queries a single warehouse of logs, metrics, and traces, and exposes the same data to Claude or Cursor over MCP.
An AI investigation goes faster when it never has to cross a product boundary. See Better Stack AI SRE.
Both alert well. On-call is where they differ.
Splunk's detectors evaluate streaming data, so alerts fire within seconds, and they route to Splunk On-Call, ServiceNow, Slack, and other tools. Splunk On-Call, the former VictorOps, is sold separately, and analysts have described it as being maintained rather than actively developed since Cisco acquired Splunk. Our incident.io vs Splunk On-Call comparison looks at what that means for teams relying on it.
Grafana bundles its own pager, IRM, which manages schedules and escalation, pages by phone or text, and opens incidents from a panel. Three active users are free and the rest cost $20 each.
| Alerting and on-call | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| Alert evaluation | On stored data | ✔, streaming |
| On-call rotations | ✔, Grafana IRM | Splunk On-Call, separate |
| Phone and SMS paging | ✔ | Via Splunk On-Call |
| Incident management | ✔ | Via integrations |
| Status pages | ✘ | ✘ |
Splunk pairs fast alerts with an on-call product in maintenance mode, and Grafana's pager comes without status pages. Better Stack combines paging with unlimited calls and texts for $29 per responder, incident channels in Slack or Teams, and status pages, running on the same data that triggered the alert.
The quickest alert in the world still depends on the pager it lands in. Explore Better Stack incident management.
The two pricing models count different things.
After a $19 monthly fee, Grafana Cloud Pro bills overages on its free allowances: series beyond 10,000 at $6.50 per 1,000, logs and traces beyond 50 GB each at about $0.45 per GB, and users beyond three at $8, or $20 for IRM users.
Splunk publishes per-host rates billed annually: Infrastructure at $15 per host per month, App and Infrastructure at $60, and End-to-End at $75, which adds RUM, synthetics, and Log Observer Connect. Standalone APM costs $55 per host, RUM $14 per 10,000 sessions, synthetics $1 per 10,000 runs, and Database Monitoring $75 per instance. A free edition covers up to 15 hosts. Log storage in Splunk Cloud Platform is quoted separately, with ingest list rates widely reported around $150 to $200 per GB per day before discounts.
Take 50 microservice hosts emitting about 50,000 active series plus 300 GB of logs and 100 GB of traces monthly, run by 15 engineers.
| Monthly cost | Grafana Cloud Pro | Splunk App and Infrastructure | Splunk End-to-End |
|---|---|---|---|
| Hosts or platform | $19 | 50 at $60, $3,000 | 50 at $75, $3,750 |
| Metrics and traces | About $260 for metrics, about $23 for traces | Included in host price | Included in host price |
| Logs | 250 GB billable, about $113 | Splunk Platform, quoted separately | Splunk Platform, quoted separately |
| Users | 12 beyond 3, $96 | Not charged per user | Not charged per user |
| On-call | IRM, $20 per user beyond 3 | Splunk On-Call, separate | Splunk On-Call, separate |
| Approximate total | About $510 | About $3,000, plus logs | About $3,750, plus logs |
Grafana Cloud is far cheaper at list price, and the gap widens once you add a Splunk Platform contract for logs. Splunk's case rests on streaming speed, NoSample tracing, mobile and session replay, and fitting into an existing Splunk and Cisco estate. For a broader look at Splunk's costs against a usage-priced platform, our New Relic vs Splunk comparison goes into detail.
Grafana Cloud's compliance includes SOC 2 Type II and GDPR, with FedRAMP and PCI DSS available and a self-hosted open-source fallback. Splunk brings Cisco's enterprise support, a long list of certifications across its cloud products, and tight integration with Splunk Enterprise Security for SIEM. If logs and security analytics are part of your decision, our Splunk vs Elastic Stack comparison covers Splunk's log platform against its main open alternative. Ask both vendors for their latest attestations before signing.
| Enterprise | Grafana Cloud | Splunk Observability Cloud |
|---|---|---|
| SOC 2 Type II | ✔ | ✔ |
| FedRAMP | ✔ | Confirm with Splunk |
| SIEM on the same vendor | ✘ | ✔, Splunk Enterprise Security |
| Self-hosting | ✔, open-source stack | ✘ |
| Vendor ecosystem | Grafana Labs | Cisco and Splunk |
Go with Grafana Cloud when you want logs, metrics, traces, and on-call on one bill, your teams already use Prometheus and OpenTelemetry, and budget matters. It suits platform and SRE teams, organizations that want an open-source exit path, and anyone not already committed to Splunk's log platform.
Go with Splunk Observability Cloud when your organization already runs Splunk Cloud Platform or Enterprise Security, you need real-time streaming alerts, NoSample tracing, and strong mobile RUM with session replay, or you are standardizing on Cisco. Plan for separate log and on-call purchases if you do not already have them.
These products are built for different starting points. Splunk Observability Cloud is strongest as an addition to a Splunk estate, while Grafana Cloud is built to be the whole estate on its own.
So start with your logs. If they already live in Splunk Platform and your security team runs on Splunk, Observability Cloud slots in neatly beside them. If you have no Splunk contract today, buying Observability Cloud means buying a second product just to keep your logs, and Grafana covers both for less.
Splunk's MCP access centers on its log platform, and Grafana's spans several backends. Better Stack's single MCP server reaches telemetry, schedules, and incidents alike, so Claude or Cursor can query logs with SQL, check who is on call, acknowledge an incident, and build a chart in one conversation.
With everything behind one MCP endpoint, your assistant can investigate and respond without switching tools. Try Better Stack.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
Splunk covers more ground, costs more, and takes longer to deploy. Better Stack covers observability at a fraction of the price with zero-code instrumentation. A complete breakdown of both platforms for 2026.
Dynatrace vs Splunk compared across APM, log management, infrastructure monitoring, AI, security, and pricing. How one integrated observability platform with Davis AI stacks up against Splunk's multi-product depth in SIEM, ITSI, and log analytics at scale.
Sumo Logic vs Splunk compared across log management, Cloud SIEM, APM, AIOps, and pricing. How the cloud-native SaaS challenger stacks up against Splunk's multi-product SIEM and observability portfolio, including ITSI and Enterprise Security.
We use cookies to authenticate users, improve the product user experience, and for personalized ads. Learn more.