Obzly
Compare / Splunk

Obzly vs Splunk

Splunk is two products. The Splunk platform handles logs and search with SPL: Splunk Enterprise runs on your infrastructure, and Splunk Cloud Platform is the same as a managed service. Splunk Observability Cloud is a separate SaaS service for metrics, traces, RUM and synthetics. Obzly covers logs, metrics and traces in one open-source system that you host.

Checked 27 October 2026 against Splunk's own docs and pricing. Sources

Which to choose

Choose Obzly if

  • you want logs, metrics and traces in one product that you host; with Splunk, metrics and traces live in Observability Cloud, which is SaaS only;
  • you want an Apache 2.0 license and no ingest-based or per-host bill;
  • you want to send all three signals over OTLP, logs included, straight to the backend;
  • you query metrics with PromQL and send Prometheus remote write, so Grafana can sit on top;
  • you need one login across regions, with each region's metrics and traces staying put as well as its logs.

Choose Splunk if

  • your teams work in SPL and depend on Splunk apps: Splunkbase lists over 1,000 apps and add-ons;
  • you run logs at scale on your own hardware: indexer and search head clustering with SmartStore is proven, and far more mature than Obzly;
  • you need GovCloud regions with FedRAMP High or Moderate and DoD IL5, or Federated Search across Splunk deployments and Amazon S3;
  • you want real-time streaming analytics with SignalFlow, and detectors that notify ServiceNow, Opsgenie or xMatters;
  • you need RUM, continuous profiling, browser synthetic tests or SAML, none of which Obzly has.

What you run

To self-host Splunk you run Splunk Observability Cloud, Forwarders, Indexers, Search heads, Management, with indexer disks, or smartstore object storage. Obzly is one image in a few roles, plus Postgres, Valkey and object storage.Splunk, self-managed and SaaSSplunk Observability CloudSaaS only · metrics, traces, RUM, syntheticsForwarderson each hostIndexersclusteredSmartStoreSearch headsclusteredManagementdeploymentcluster mgrlicense mgrmonitoringSH deployerIndexer disks, or SmartStore object storageObzlyone imageSERVICE_MODE = all, or one role per deployment:apiworkerbrokerquerierlogs, metrics and traces in one storeplus control-plane for many SitesPostgresValkeyObject storage
The four boxes are Splunk Enterprise for logs, each indexer and search head usually on its own machine. Splunk Cloud Platform delivers it as a service that Splunk manages. Observability Cloud is a separate SaaS service. Obzly runs all three signals from one image, one role at a time.

Feature by feature

CapabilityObzlySplunk Enterprise / Cloud Platform (logs)Splunk Observability CloudSource
LicenseApache 2.0, every featureProprietary (Splunk General Terms)Proprietary; Splunk OTel Collector is Apache 2.0General TermsSplunk OTel Collector
What you runOne image in up to five roles, Postgres, ValkeyEnterprise: forwarders, indexers, search heads; Cloud is managedCollectors only; SaaS hosted in a Splunk realmEnterprise componentsCloud Platform serviceObservability Cloud service
StorageZSTD Parquet on S3, GCS, Azure Blob or MinIOSmartStore on S3, GCS or Azure (Enterprise); Cloud exports to S3/GCSIn your org's Splunk realm; own storage not supportedSmartStoreCloud Platform serviceObservability Cloud service
OTLP inLogs, metrics and traces, gRPC and HTTPCollector to HEC; OTLP add-on for Enterprise only, not CloudTraces over HTTP or gRPC, metrics over HTTP; no logsSplunk Connect for OTLPOTLP/HTTP exporterMetrics
Query languagesSearch bar and SQL for logs, PromQL, Jaeger API for tracesSPL, also used from Observability Cloud via Log Observer ConnectSignalFlow for metrics; APM UI for tracesSignalFlowLog Observer Connect
PrometheusRemote-write ingest and a PromQL APINot supportedCollector scrapes or receives remote write; PromQL not supportedRemote write receiverSupported integrations
DashboardsOwn dashboards; imports Grafana layout without queriesGrafana dashboard import not supportedSame
AlertingWebhook, Slack, PagerDuty, emailEmail and webhook built in; Slack, PagerDuty via Splunkbase appsEmail, Slack, PagerDuty, Teams, ServiceNow, Opsgenie, webhook and moreAlert actionsSlack appPagerDuty appNotification services
Synthetic checksHTTP, TLS, TCP, DNS, ICMP from your probes; no browserPart of Observability CloudBrowser, uptime (HTTP, port) and API tests; private runnersSynthetic MonitoringPrivate locations
Infrastructure inventoryClusters to containers, plus AWS and Azure resourcesPart of Observability CloudHosts, Kubernetes, and AWS, Azure and GCP servicesNavigators
RUM and profilingNeitherPart of Observability CloudRUM for browser and mobile; AlwaysOn Profiling in APMSplunk RUMAlwaysOn Profiling
SSOOIDC with any provider; no SAMLSAML, and LDAP on Enterprise; OIDC not supportedSAML; OIDC not supportedPlatform SAMLObservability Cloud service
SCIMIncludedSet up with SAML; documented for Okta on Cloud PlatformNot supportedSSO with Okta
RBAC and audit logPer-project roles, teams, audit log with CSV exportRoles; audit events in index=_auditBuilt-in and custom roles via Cloud Platform; Audit Events APIAudit Events APICustom rolesAuditing
MCP serverBuilt in at /mcp, read-onlySplunk MCP Server app from SplunkbaseHosted MCP gateway; not in Google Cloud or GovCloud realmsPlatform MCP ServerObservability MCP
Many regionsControl plane in front of many SitesFederated Search across Splunk deploymentsOne realm per org; a view across realms not supportedCloud Platform serviceObservability Cloud service
PriceFree; you run the infrastructureIngest or workload pricing by quote; Free license 500 MB/dayInfrastructure from $15 per host/month, billed annually; free editionPricingObservability pricingLicense types

Moving from Splunk

  1. Run Obzly where your data must live. Install it in your own cluster or cloud account. Helm
  2. Send to both. Add an OTLP exporter for Obzly to your OpenTelemetry Collector next to the Splunk exporters, so both receive the same data. Collector guide
  3. Bring logs over OTLP. Logs that reach Splunk through forwarders need a Collector or another OTLP sender to reach Obzly. Send logs
  4. Rebuild searches, charts and detectors. SPL searches and SignalFlow charts don't carry over. Recreate them with Obzly's log search, SQL and PromQL, and turn detectors and alerts into Obzly alert rules. Alerts
  5. Move uptime and API tests. Recreate them as HTTP, TLS, TCP, DNS or ICMP checks from your own probes. Obzly synthetics need a control plane, and browser tests have no equivalent. Synthetics
  6. Switch off Splunk once Obzly has your full retention.

Sources

Every Splunk fact on this page comes from its vendor's own pages, read on 27 October 2026. Plan names and prices change; check the linked page before you decide.

Spotted something out of date? Open an issue.