In terms of setup cost, pricing, and licensing, Splunk User Behavior Analytics is not an inexpensive product. The setup requires numerous components including storage, networking, identity access, integration, and backup. Cost-wise, with pay-as-you-go options, the pricing can be extensive. The licensing model includes various options. Reserved instances with one or three-year commitments offer lower rates, providing up to 70% savings. The Bring Your Own License (BYOL) option allows use of existing Microsoft, Red Hat, or Oracle licenses with software assurance. The Service Provider License Agreement (SPLA) model offers monthly usage-based licensing for service providers.
The pricing is based on the amount of data processed, and it is considered a high-level investment for enterprises. Costs can be cut through efficient use and implementation.
It's too expensive. If you need observability, you will pay for the whole package of observability. But if you need anything in security, you will pay for the whole package, then you can select the use case that you need. I think it might be broken into simpler packages. The licensing cost per day is too expensive.
I am not aware of the price, but it is expensive. A rough estimate would be around 150 gigabytes, given the huge amount of data. At the moment there are no additional costs for maintenance.
Learn what your peers think about Splunk User Behavior Analytics. Get advice and tips from experienced pros sharing their opinions. Updated: June 2025.
Global Engineer at a financial services firm with 10,001+ employees
Real User
2020-09-21T06:33:00Z
Sep 21, 2020
The solution isn't overly expensive. It's quite affordable. It's not the priciest option on the market. I'm not sure of the exact cost as its not an aspect of the solution I directly deal with.
Right now, they have two licensing models, a perpetual license and a term license with an annual subscription. Splunk decided that they would stop the perpetual licensing model, which means that customers will need to buy a subscription going forward.
Senior Security Engineer at a government with 1,001-5,000 employees
Real User
2019-08-18T07:52:00Z
Aug 18, 2019
There are a few things about the price. There are several packages but if you want to use it as an enterprise, you have to pay enterprise price. That is the initial price is for the basic enterprise application, but you get charges for volume use, not per user. Initially, we bought 100GB and now we bought 200GB. Other applications you want to install for additional, integrated functionality costs more. For example, for Splunk they have two modules you need to use it optimally, I think. One is for applications. It's called Splunk Enterprise Security. After that, you will want to purchase another application called Defense. So it's more than one model for pricing. The more you use, the more you pay. It comes with unlimited users and volume discounts.
Security PS Supervisor at a tech services company with 1,001-5,000 employees
Real User
2019-08-13T10:41:00Z
Aug 13, 2019
The solution is relatively expensive. There are costs above the standard licensing as well. Pricing varies according to the customer's needs and set up. Pricing depends on the licensing model and if the normal log management licensing model or the security plus license. It also depends on the licensing model and the platform required by the customer. It can further depend on if the customer owns a Splunk hardware platform, or if they can host these licenses and subscriptions on their own platform. It can vary depending on the OPEX model and CAPEX model as well. There are a lot of variables that encompass the total cost of the solution. I believe that Splunk is about 50% more expensive than other solutions.
Information Security Manager at a financial services firm with 201-500 employees
Real User
2019-03-11T07:21:00Z
Mar 11, 2019
Pricing is the problem with Splunk. You can never know the pricing for next year. Every single time you adjust to something new, the price goes up. It's impossible to truly budget for it. It goes up constantly. You can plan for 2x and it will be 3x. You only find out in the long run.
BS Systems Engineer at a tech services company with 501-1,000 employees
Real User
2018-12-02T07:45:00Z
Dec 2, 2018
I hope we can increase the free license to be more than five gig a day. This would help people who want to introduce a POC or a demo license for the solution.
Splunk User Behavior Analytics is a behavior-based threat detection is based on machine learning methodologies that require no signatures or human analysis, enabling multi-entity behavior profiling and peer group analytics for users, devices, service accounts and applications. It detects insider threats and external attacks using out-of-the-box purpose-built that helps organizations find known, unknown and hidden threats, but extensible unsupervised machine learning (ML) algorithms, provides...
In terms of setup cost, pricing, and licensing, Splunk User Behavior Analytics is not an inexpensive product. The setup requires numerous components including storage, networking, identity access, integration, and backup. Cost-wise, with pay-as-you-go options, the pricing can be extensive. The licensing model includes various options. Reserved instances with one or three-year commitments offer lower rates, providing up to 70% savings. The Bring Your Own License (BYOL) option allows use of existing Microsoft, Red Hat, or Oracle licenses with software assurance. The Service Provider License Agreement (SPLA) model offers monthly usage-based licensing for service providers.
The pricing is based on the amount of data processed, and it is considered a high-level investment for enterprises. Costs can be cut through efficient use and implementation.
Comparing with the competitors, it's a bit expensive.
Splunk is up to the mark in terms of pricing. However, I cannot provide specific comments on the pricing at the moment.
It's too expensive. If you need observability, you will pay for the whole package of observability. But if you need anything in security, you will pay for the whole package, then you can select the use case that you need. I think it might be broken into simpler packages. The licensing cost per day is too expensive.
I am not aware of the price, but it is expensive. A rough estimate would be around 150 gigabytes, given the huge amount of data. At the moment there are no additional costs for maintenance.
I'm not sure of the exact licensing fees.
We simply use the free demo version of the product. We do not pay any licensing fees at this time.
The solution isn't overly expensive. It's quite affordable. It's not the priciest option on the market. I'm not sure of the exact cost as its not an aspect of the solution I directly deal with.
Our licensing costs are on a yearly basis.
Right now, they have two licensing models, a perpetual license and a term license with an annual subscription. Splunk decided that they would stop the perpetual licensing model, which means that customers will need to buy a subscription going forward.
The licensing costs is around 10,000 dollars.
There are a few things about the price. There are several packages but if you want to use it as an enterprise, you have to pay enterprise price. That is the initial price is for the basic enterprise application, but you get charges for volume use, not per user. Initially, we bought 100GB and now we bought 200GB. Other applications you want to install for additional, integrated functionality costs more. For example, for Splunk they have two modules you need to use it optimally, I think. One is for applications. It's called Splunk Enterprise Security. After that, you will want to purchase another application called Defense. So it's more than one model for pricing. The more you use, the more you pay. It comes with unlimited users and volume discounts.
The solution is relatively expensive. There are costs above the standard licensing as well. Pricing varies according to the customer's needs and set up. Pricing depends on the licensing model and if the normal log management licensing model or the security plus license. It also depends on the licensing model and the platform required by the customer. It can further depend on if the customer owns a Splunk hardware platform, or if they can host these licenses and subscriptions on their own platform. It can vary depending on the OPEX model and CAPEX model as well. There are a lot of variables that encompass the total cost of the solution. I believe that Splunk is about 50% more expensive than other solutions.
Pricing is the problem with Splunk. You can never know the pricing for next year. Every single time you adjust to something new, the price goes up. It's impossible to truly budget for it. It goes up constantly. You can plan for 2x and it will be 3x. You only find out in the long run.
There are additional costs associated with the integrator.
I hope we can increase the free license to be more than five gig a day. This would help people who want to introduce a POC or a demo license for the solution.