33 named organizations publicly flagged Splunk cost pressure — and 28 of them cut, replaced, or rejected it

Asked:

“what companies have complained about their splunk costs? scour everything, including reddit and forums, and linkedin, etc.”

Six broad search passes across engineering blogs, vendor customer stories, conference slides, LinkedIn, Reddit, Hacker News, Splunk Community, Spiceworks, Stack Overflow and Medium screened thousands of results and yielded 33 named organizations with attributable public evidence of Splunk cost pressure — a best-effort public-web census, not a provably complete universe, since no authoritative list of all complaints exists. “Complained” is read broadly but transparently: explicit negative wording plus concrete cost-pressure behavior and savings evidence count, and every row carries its evidence tier so direct employee statements can be told apart from vendor marketing and anonymous forum testimony. The 33 rows span 15 independent source hosts; the largest, cribl.io, backs 8 of 33 (24.2%).

Every organization by evidence tier and response

Rows: evidence tier, strongest at top. Columns: what the company did about the cost. Colour = response. Hover or tap a company for its complaint, speaker and amount.

Replaced or migrated from Splunk Reduced or optimized usage Evaluated and rejected Complaint only, disposition unclear

Findings

T-Mobile is the largest quantified case: a principal engineer credits the migration off Splunk with $28.8M in savings (800 servers down to 80) plus $4.8M in annual license savings — linkedin.com

Cost pressure does not always mean leaving: 14 organizations kept Splunk and optimized around it, like BILL, which cut Splunk ingestion and cost by 50%+ after VPC flow-log costs jumped over $1M in months — observo.ai

LinkedIn profiles proved the richest direct source — six named engineers at Acxiom, Progress ShareFile, Publix, T-Mobile, TrackCode and VISA describe their own employers' Splunk costs first-hand — linkedin.com

Hacker News supplied the only firsthand-but-anonymous claims, covering Expedia, LinkedIn and Netflix; Reddit's sole named-company hit was outsider joking about Cisco and was excluded — news.ycombinator.com

Evidence table

Quantified amounts are not necessarily pure Splunk license savings unless the row says so — some include infrastructure, storage, ingestion or broader SIEM savings. Vendor-published rows may be biased toward the vendor's product.

Organization	Tier	Response	Speaker	Complaint	Amount	Action	Source context	Source

Method: 33 rows, one per named organization with attributable public evidence of Splunk cost complaints, gathered via six search passes across blogs, vendor case studies, conference slides, LinkedIn, Hacker News, Reddit and forums; compiled 2026. Tiers: 10 direct first-person, 16 attributed customer case studies, 4 vendor-narrated, 3 anonymous-firsthand. Amounts quote the source and may mix license, infrastructure, storage and SIEM savings. Unnamed customers, outsider speculation and non-Splunk complaints were cut. 15 source hosts; cribl.io backs 8 rows (24.2%).

This report was generated automatically by Keenable SELECT at a user's request, from publicly available web sources linked herein. Keenable does not review, verify, or endorse its contents and makes no representation as to accuracy, completeness, or timeliness; AI-based extraction may contain errors. Nothing in this report is investment, legal, financial, or other professional advice. All trademarks and referenced content remain the property of their respective owners; no affiliation or endorsement is implied. To report an error, rights concern, or request removal: legal@keenable.ai.