68 public complainants about Splunk costs — and 65 of them acted on it

Asked (summary):

Who has complained about their Splunk costs? Scour everything — the general web, Reddit, forums, LinkedIn and more.

A broad web census of publicly attributable Splunk cost complaints found 68 distinct complainants with strong evidence, spread across 20 independent hosts: 41 named-organization case studies, 22 pseudonymous firsthand accounts and 5 named firsthand accounts. 45 give a quantified cost, volume or savings figure, and 65 report an action — migration, filtering, restricted ingestion or renegotiation. This is the complete strong-evidence shortlist from the search, not every complaint ever published; LinkedIn was searched but yielded few posts meeting the attribution threshold.

Who complains, and how strongly it is attributed

Complainants by source type, coloured by attribution strength — darker means stronger firsthand attribution; vendor-hosted case studies can be commercially motivated

Firsthand, named person (5) Firsthand, pseudonymous (22) Named-organization case study (41)

Findings

Ani Sridharan reports over $13M in annual savings after moving 100+ engineering teams off per-unit licensing, including Splunk, to a self-hosted LGTM stack — anisri.dev

A fintech infrastructure engineer puts their Splunk line item at $650K a year plus $45K in AWS egress just to move logs in, before switching to a BYOC SIEM at under 10% of the cost — dev.to

Autodesk's Steve Litras says log volume outgrew the budget, so the team repeatedly turned off ingestion of large chunks of logs to stay under the Splunk license — cribl.io

On Reddit, cost complaints centre on pricing mechanics — pay-by-gig math, oversized SVC workload sizing and sour renewals — with one user citing $10M a year on Splunk alone — costbench.com

The complete evidence table

Complainant	Attribution	Source type	Complaint	Quantified detail	Reported action	Date	Source

Method: broad web census of publicly attributable Splunk cost complaints — general web, Reddit, Hacker News, Splunk and independent forums, LinkedIn and social pages, engineering blogs, migration stories and customer case studies. 68 deduplicated complainants across 20 independent hosts; the largest single host supplies 23 rows (33.8%). A figure is whatever the complainant published — a bill, volume, multiplier or savings claim — spanning different deployment sizes, dates, products and contract structures, so dollar amounts are not directly comparable. Vendor-hosted and anonymous accounts are testimonials, not audited bills. Complaint, detail and action texts are shortened in the table for space; the linked source holds the full account.

This report was generated automatically by Keenable SELECT at a user's request, from publicly available web sources linked herein. Keenable does not review, verify, or endorse its contents and makes no representation as to accuracy, completeness, or timeliness; AI-based extraction may contain errors. Nothing in this report is investment, legal, financial, or other professional advice. All trademarks and referenced content remain the property of their respective owners; no affiliation or endorsement is implied. To report an error, rights concern, or request removal: legal@keenable.ai.