New Relic vs. Splunk: a side-by-side comparison for 2026

New Relic and Splunk are both enterprise observability platforms, and that's roughly where the similarity ends. New Relic was purpose-built for observability from day one: one database, one query language, one investigation flow from alert to trace to log to infrastructure metric. Everything is designed to work together because it was designed together. Splunk grew differently. It started as a log search engine, acquired SignalFx for infrastructure monitoring, absorbed VictorOps for on-call, and landed inside Cisco's portfolio alongside AppDynamics. The result is a portfolio of genuinely capable products that don't always share a data model, a query language, or a pricing dimension with one another.

That architectural difference produces the real tension in this comparison. New Relic's unified approach means the investigation workflow is smooth and the learning curve is contained, but the seat-based pricing compounds aggressively with engineering team size. Splunk's multi-product approach means you're navigating between Observability Cloud, the Cloud Platform, ITSI, and On-Call during a production incident, but the depth in each product is real, and the security capabilities in Splunk Enterprise Security are genuinely in a different category from anything New Relic offers.

The question this comparison actually answers is narrower than it looks: if your primary need is full-stack observability for engineering and SRE teams, which platform gives you the better experience at a price that makes sense? If your evaluation includes SIEM, enterprise security operations, or large-scale service health modeling for IT operations teams, Splunk has capabilities New Relic simply does not match. If it doesn't, New Relic's unified approach is easier to use, easier to price, and often significantly cheaper at the same feature set.

Quick comparison at a glance

Platform architecture and philosophy

New Relic: one database for engineers who need to move fast during incidents

New Relic's architecture flows from one design decision: put everything in NRDB, make it queryable with NRQL, and let engineers move from alert to trace to log to infrastructure metric without ever switching interfaces or learning a new query syntax. Every product New Relic ships reads from the same database. When something breaks at 3am, the investigation workflow is the same regardless of whether you're looking at an APM anomaly, a log pattern, or an infrastructure degradation. You pay for how much data you send and which engineers need full access.

Splunk: multiple products with genuine depth in each

Splunk's portfolio spans several distinct products: the Cloud Platform for log ingestion and SPL-based search, Observability Cloud for infrastructure monitoring, APM, RUM, and synthetic testing, ITSI for AIOps and service health management, On-Call for incident notification and scheduling, and Enterprise Security for SIEM and threat detection. Each product has been developed for its specific domain and has real depth. What they share is Cisco's infrastructure and a common go-to-market, not a common data model or query language.

The investigation workflow this produces is different from New Relic's. An incident that spans log patterns (Cloud Platform), service performance degradation (Observability Cloud), and on-call status (On-Call) requires navigating between three products and three interfaces. For organizations where different teams own each of those domains, that separation is sometimes fine. For a single SRE team trying to move fast during an incident, the context-switching is real overhead. How many times per month does your team pivot between Splunk products during a single investigation? That transition cost doesn't appear on any pricing page but shows up clearly in MTTR.

Splunk's pricing is a category unto itself. Four distinct models: workload-based on Splunk Virtual Compute units for the Cloud Platform, entity-based at per-host rates for Observability Cloud, ingest-based at roughly $150 to $225 per GB per day at base tiers for log management, and activity-based on metric time series and trace volume for specific Observability Cloud features. Choosing the wrong model for your data patterns can mean paying significantly more than your initial estimate, and the models interact with each other in ways that require careful planning.

APM and distributed tracing

Both platforms are genuinely OTel-native and neither charges a surcharge for it, which is worth calling out before comparing anything else. That shared commitment matters if your organization has standardized on OpenTelemetry as a vendor-neutral instrumentation approach.

New Relic: thread-level APM with infinite trace retention

New Relic offers traditional language-specific APM agents alongside its eBPF-based eAPM for zero-code Kubernetes instrumentation. Thread-level CPU profiling shows exactly which function is consuming cycles in production. Infinite Tracing retains the most significant traces out of 100% of collected data without sampling blindly, which matters for debugging intermittent performance issues that sampling would miss. APM 360 connects frontend sessions to backend traces within the same interface.

Splunk: code-level profiling and NoSample tracing across every span

Splunk APM in Observability Cloud offers NoSample end-to-end visibility, collecting and retaining full-fidelity trace data across all connected services without sampling decisions to manage. AlwaysOn Profiling is a meaningful differentiator: continuous CPU and memory profiling for Java, .NET, and Node.js at the code level, running in production without requiring a separate profiling session to be triggered. For teams debugging performance regressions at the function level, this goes deep.

The honest tradeoff on the investigation side: Splunk APM lives in Observability Cloud, which has its own interface separate from the Cloud Platform where your logs live. Log Observer Connect bridges the two products, allowing log queries from within Observability Cloud, but it's an integration on top of a split architecture rather than a native unified design. New Relic's seamless pivot from a trace to the surrounding logs happens because they're in the same store. Splunk's equivalent requires a configured bridge between two products.

Log management

This is where the platforms diverge most sharply in both capability and cost, and where Splunk's legacy as a log search engine creates the sharpest contrast with New Relic's more recent entry into log management.

New Relic: all logs searchable through NRQL, straightforward per-GB pricing

New Relic makes every ingested log searchable through NRQL, no separate indexing tier, no archive decisions to make, with AI alert summarization generating a hypothesis when a log-triggered alert fires. The 100GB/month free tier absorbs most of what a small team generates, and $0.40/GB beyond that is simple to model. Seven-year retention without rehydration is available for compliance use cases. The cross-signal correlation works naturally because logs and traces share the same backend.

Splunk: SPL-native log search at petabyte scale, with pricing that reflects that scale

Splunk's log management is what Splunk was built for. SPL (Splunk Processing Language) is genuinely expressive for complex log analysis: multi-step transformations, statistical aggregations, subsearch, lookups against external data sets, time-series charting, and the 2,000+ Splunkbase apps that encode years of community knowledge for specific log sources and use cases. Organizations that have built years of saved searches, dashboards, and detection rules in SPL have a real investment that doesn't transfer to a new query language.

What SPL expertise and petabyte-scale log analytics cost: ingest pricing for Splunk Cloud Platform runs roughly $150 to $225 per GB per day at base tiers based on Vendr transaction data. At 100GB per day of log ingestion, that's $15,000 to $22,500 per month for the platform before adding observability, ITSI, or security products. At 100GB per month (a much smaller team), New Relic's cost is $0 in ingest fees since it falls within the free tier. That gap is large enough that log volume is often the primary driver of cost comparison outcomes between these two platforms.

Flex Index provides tiered storage for cost management, keeping frequently queried data on hot nodes and moving historical data to cheaper cold storage. It's a useful cost lever at the scale where Splunk operates, though it adds configuration complexity that New Relic's flat pricing avoids.

Infrastructure monitoring and cloud metrics

Both platforms handle infrastructure monitoring with no OTel surcharges, which puts them on equal footing for teams using OpenTelemetry exporters. The differences are in pricing structure and what the monitoring data connects to during an investigation.

New Relic: cloud-native coverage, gated by full platform seat

New Relic's infrastructure monitoring covers Linux, Windows, and macOS, with no-agent cloud integrations for AWS, Azure, and GCP. Kubernetes monitoring is solid. Cardinality doesn't create penalty charges. The access restriction consistent across New Relic's entire product applies here too: viewing infrastructure data during an incident requires a full platform seat at $349/month Pro, so engineers without that access provisioned are locked out when it matters.

Splunk: entity-based infrastructure with AI infrastructure monitoring for AI workloads

Splunk Infrastructure Monitoring is built on the SignalFx acquisition and uses entity-based pricing at around $15/host/month for infrastructure only. Custom metrics beyond the per-host allotment (200 MTS on Enterprise, 100 on Standard) count against entitlements with overage charges, which creates the familiar cardinality problem for teams using high-dimensional tags. Metrics Pipeline Management lets teams route specific metric time series to cheaper archive storage at roughly a 10x cost reduction, which is a useful cost lever but an additional configuration burden.

The meaningful differentiator Splunk has here in 2026: AI Infrastructure Monitoring. Dashboards and detectors covering GPU performance, LLM token costs, model latency, vector database performance, and AI orchestration frameworks are generally available. For teams running LLMs or AI agents in production alongside traditional infrastructure, Splunk has native visibility into the AI layer that New Relic's AI Observability covers at the application level but doesn't match for GPU-level infrastructure metrics.

Digital experience monitoring

Both platforms have mature DEM offerings. New Relic is a two-time consecutive Gartner Magic Quadrant Leader for DEM. Splunk's Digital Experience Analytics reached GA in March 2026, combining behavioral data with RUM and APM signals for product and UX teams. The meaningful gap is mobile: Splunk's native SDK support for iOS, Android, React Native, and Flutter is broader than what New Relic offers for mobile RUM specifically. Session replay is available on both.

The frontend-to-backend correlation difference matters at the investigation level. New Relic's APM and RUM share the same NRDB backend, so clicking from a slow user session to the backend trace that caused it is a single action. Splunk's equivalent requires RUM in Observability Cloud correlating to APM in Observability Cloud correlating through Log Observer Connect to logs in the Cloud Platform. The correlation is designed to work, but it requires all three products to be fully instrumented and configured.

AI capabilities

Both companies have invested heavily in AI in 2025 and 2026, and both have MCP servers now generally available or close to it. The architectural difference in their AI investment reflects their broader product philosophies.

New Relic: proactive SRE agent, mostly still in preview

The SRE Agent, launched February 2026, fires automatically when an alert triggers and starts investigating without anyone prompting it. By the time you open your laptop it has typically identified a likely root cause from APM traces, logs, and recent deployments. The Agentic Platform adds a no-code agent builder, orchestration, and MCP support targeting Claude, Cursor, and other AI coding assistants. Applied Intelligence, which groups related alerts and generates summaries, is GA today. The honest caveat: the SRE Agent and most of the Agentic Platform remain in Preview.

Splunk: AI Troubleshooting Agent, hosted models, and the deepest AI infrastructure monitoring on the market

Splunk's AI investment is substantial and shipping faster than New Relic's on several dimensions. The AI Troubleshooting Agent and Remediation Plan in Observability Cloud provides root cause summaries during incident investigation directly in context. The MCP server for Observability Cloud is generally available, supporting Claude Desktop, VS Code, Cursor, and other MCP-compatible clients.

Splunk hosted AI models went GA in February 2026, bringing foundation models including a security-specific model and general-purpose models directly into the platform, removing the dependency on external AI providers for Splunk's AI features. For security, Splunk's AI story extends to Attack Discovery for threat correlation and the Elastic AI SOC Engine equivalent in Detection Studio.

The category where Splunk has no competition: AI Agent Monitoring is generally available, covering GPU performance, LLM token economics, model latency, vector databases, and AI orchestration frameworks. For teams building AI-powered products in production, this visibility layer doesn't exist at this level of specificity in New Relic's current offering.

Security capabilities

This is the section that most clearly separates the platforms, and if security is part of your evaluation, it deserves honest treatment.

New Relic's security posture is compliance-based: SOC 2, HIPAA on Data Plus, FedRAMP Moderate expanding to High. Security RX, previewed in 2026, correlates vulnerability findings with engineering context. There is no SIEM, no SOAR, no threat detection, no UEBA. If security monitoring is a requirement, New Relic is not in the conversation.

Splunk Enterprise Security is an 11-time Gartner Magic Quadrant Leader for SIEM. The platform covers detection, investigation, and response at enterprise scale with SIEM, SOAR, UEBA, Detection Studio for custom detection development, and Attack Analyzer for automated forensic analysis of phishing and malware. Detection rules are MITRE ATT&CK aligned and available on GitHub, meaning they're inspectable and community-hardened. AI-powered triage using Splunk's hosted foundation models reduces manual alert review overhead.

The consolidation argument for Splunk is real: if your organization is evaluating observability and security as a combined procurement decision, Splunk's architecture supports running both on the same platform. SPL expertise built for observability transfers directly to security analytics. The operational teams share tooling. For organizations already committed to Splunk for security, adding observability to that contract is often less friction than adding a separate observability platform.

IT Service Intelligence and AIOps

ITSI deserves its own section because it represents a capability New Relic does not have and cannot replicate with its current product set.

Splunk ITSI is a premium AIOps product for IT operations teams managing large, complex service environments. Its core capability is service health monitoring: you model your IT services as entities with KPIs derived from metrics, logs, and events, then ITSI monitors health scores in real time and predicts degradations before they become outages. When issues occur, ITSI automatically correlates related events into episodes, reducing alert noise significantly. For large enterprise IT operations teams managing hundreds of services, business processes, and dependencies, ITSI's service modeling and adaptive thresholding capabilities address problems that observability-focused tools aren't designed to solve.

New Relic has Applied Intelligence for alert correlation and anomaly detection, which covers the basic noise reduction problem. It doesn't model services as business entities with KPIs, doesn't do predictive health scoring, and doesn't produce the kind of episode-based incident management that ITSI provides for IT operations teams at enterprise scale.

Pricing comparison

Comparing these two platforms on price requires being specific about what you're comparing, because the models are so different.

At small scale, New Relic wins clearly. The 100GB/month free tier is genuinely usable, one full platform user is included, and basic users are free. A small team of three engineers can run New Relic for months without paying anything. Splunk has no equivalent free offering.

At large scale with heavy log volumes, Splunk's pricing model can be negotiated differently than list price suggests, but the baseline economics of $150 to $225 per GB per day for log ingestion are difficult to compare favorably against New Relic's $0.40/GB. A team ingesting 500GB of logs per day pays roughly $75,000 to $112,500 per month at Splunk list rates for log ingestion alone, versus $5,900 per month for the same volume on New Relic.

At large scale with large engineering teams, New Relic's seat model creates its own ceiling. A team of 25 engineers all needing full platform access on Pro pays $8,725 per month in seat fees before a byte of telemetry applies. Splunk Observability Cloud has no per-user fee for viewing data.

Scenario: 15 engineers with full access, 300GB/month telemetry, 50GB/day logs

This scenario illustrates that New Relic's seat cost, while real, often runs lower than Splunk's entity plus log ingestion costs for teams with moderate data volumes. The scenario flips when log volumes are small but team size is very large, or when Splunk's enterprise negotiated rates bring ingest costs well below list price.

Splunk's flexibility around pricing models is genuine: workload-based pricing can be more predictable than ingest-based for teams with variable data patterns, and enterprise contracts regularly discount 30 to 50 percent off list. Any serious Splunk evaluation should include a custom quote rather than relying on list prices.

What each platform genuinely lacks

New Relic gaps worth knowing:

1. Seat costs at $349/month per full platform user compound quickly for larger engineering teams.
2. No self-hosted or air-gapped deployment at any tier.
3. No SIEM, SOAR, threat detection, or UEBA.
4. No ITSI-equivalent for service health modeling and predictive AIOps.
5. SRE Agent and most of the Agentic Platform remain in Preview.
6. No status pages and no unlimited native on-call delivery included.
7. No GPU or AI infrastructure monitoring comparable to Splunk's AI Infrastructure Monitoring.

Splunk gaps worth knowing:

1. Log ingest pricing at list rates ($150 to $225/GB/day) is significantly higher than New Relic's $0.40/GB for the same volume.
2. The multi-product architecture creates investigation friction: log queries during an APM investigation require a bridged product.
3. No unified query language: SPL for the Platform, a separate UI for Observability Cloud.
4. On-call scheduling requires Splunk On-Call as a separate SKU.
5. No status pages.
6. No free tier; evaluation requires a trial or paid engagement.
7. Pricing complexity across four models requires careful planning to avoid unexpected costs.
8. Self-managing Splunk Enterprise adds significant operational overhead.

Final thoughts

The comparison resolves more clearly than it might appear once you separate the two most likely evaluation scenarios.

If your team is engineering and SRE focused, debugging production applications, and your primary requirements are APM, distributed tracing, log correlation, and infrastructure monitoring, New Relic is the stronger product. The unified investigation workflow, the genuinely usable free tier, the OTel-native approach without surcharges, and the simpler pricing model all point toward New Relic for this buyer. The seat cost is the main variable to model carefully: if your engineering team is small relative to your data volume, New Relic often runs cheaper. If your team is large and everyone needs investigative access, that math shifts.

If your organization needs SIEM, enterprise security operations, or ITSI-style service health modeling alongside observability, Splunk is the only platform in this comparison that can deliver it. The security capabilities are genuinely in a different category, and for organizations already running Splunk for security, adding observability to that contract is a legitimate consolidation play. The log analytics depth at petabyte scale is also real in a way that New Relic's log management doesn't match at the extreme end.

If your primary driver is reducing your current Splunk log ingestion bill without losing observability capability, that's worth evaluating seriously against New Relic's per-GB model. The gap in list price log ingestion rates is large enough that the seat cost math on New Relic often still comes out ahead for moderate-volume teams. Run the actual numbers on your specific log volume before assuming either direction.

The one uncomfortable truth this comparison produces: teams that need both serious observability for engineers and serious security for operations teams will often end up running both products, or supplementing whichever one they standardize on with something else. Neither platform covers the full picture, and forcing one team onto the other's preferred tool usually produces frustration on both ends.

Got an article suggestion? Let us know

Explore more

Datadog vs. New Relic: a side-by-side comparison for 2026

I have deployed, tried and tested Datadog and New Relic, to help you pick the right observability platform.

10 Best New Relic Alternatives in 2026

There are many alternatives to New Relic's APM offering a better, less complicated and more reliable solution to application monitoring.

Datadog vs. Splunk: a side-by-side comparison for 2026

Datadog and Splunk are both tools designed to help organizations collect, store, and analyze log data. In this article, we are going to compare the two products in detail to help you find out which one is better suited for your project.

10 Best Splunk Alternatives to Consider in 2026

Splunk is one of the best-known observability and SIEM tools in the software industry, but it isn’t suitable for all organizations. This article examines 10 alternatives for log management, observability, and application monitoring.

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.