New comment on reddit

Main problem with Splunk is that it is extremely expensive. It gets to a point where many organizations say screw it, we're gonna go with ELK, Azure Log Analytics, or some other product that is cheaper/less expensive/free.

The "problem" with FLOSS solutions is that they appear "free" – but always come with their own attendant, sometimes external, costs: Is ELK stack "cheaper" than Splunk?

Maybe..

Maybe not

And with other commerical offerings, you have the same questions: is Scalyr cheaper than Splunk?

Maybe.

Maybe not.

Splunk, in some ways, is where Oracle was 25 years ago – in the 90s, Oracle was practically giving-away training and experience to college students so that when they graduated their only "database experience" was with Oracle (pretty brilliant marketing, honestly)

Splunk is not cheap.

But it also does a lot that other platforms either don't do – or don't do very well: and that's its massive strength – it can scale more-or-less "infinitely" (there are multi-petabyte customers out there) and will digest more-or-less anything you throw at it.

For niche activities and data sources, there are "better" tools.

But for "any" data source? Probably not [today].

Splunk's the 800-pound-gorilla in data processing, search, SIEM, log retention, etc: but if they don't watch their backs, they'll get shot in the head by a poacher looking to stuff a rare head on their wall.