# Last9 vs Splunk: A Splunk Alternative in Your Cloud

> Last9 vs Splunk Observability Cloud compared on AI and MCP, where the AI runs, pricing, metric cardinality, ingest-time control, logs, query languages, and deployment in your own cloud account, with where each one fits.

Source: https://last9.io/compare/splunk/

Both have an AI SRE agent and an MCP server. Last9 runs its agent on your model provider, with no charge per investigation, inside your own cloud account, on one licence for metrics, logs, and traces. Splunk splits them: Observability Cloud holds metrics and traces, priced per host, and logs stay on the Splunk platform, next to its SIEM.

- **Gartner Cool Vendor 2025:** Named a Gartner® Cool Vendor in AI for SRE and Observability, cited for its unified telemetry platform.
- **Your model, your cloud:** The Last9 agent runs on your model provider, with no per-investigation charge, in your own cloud account.
- **One licence:** Metrics, logs, and traces on one licence, with no charge per label or metric name. The infrastructure runs on your own cloud bill.

## Last9 vs Splunk at a glance

The questions engineering teams ask when they compare the two. Splunk Observability Cloud is the product compared here, with the Splunk platform named where logs, deployment, and security are concerned.

| | **Last9** | **Splunk** |
|---|---|---|
| Does it have an MCP server for coding agents? | ✓ Yes, hosted, since March 2025, for any MCP client. An agent can act through it: add drop rules and edit dashboards | Yes, since July 2025. Its built-in tools query and search. Writes need custom tools that an admin builds |
| What does the AI cost? | ✓ No per-query or per-investigation charge. The Last9 agent is generally available, in the app, in Slack, and in your IDE | No published price for AI SRE. Agent Observability, for LLM apps and coding agents, is a separate SKU |
| Can the AI use our model provider, in our own cloud? | ✓ Yes. The Last9 agent runs on your model provider or inference endpoint, inside your own cloud account, and picks the model for each step | No published option in Observability Cloud. Its AI runs in Splunk's own service |
| How is it priced? | ✓ One licence. The infrastructure runs on your own cloud bill, at your negotiated rates | Per host, in three tiers. Logs need a separate Splunk platform licence |
| How much metric cardinality can I keep? | ✓ No hard limit. 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name | 100 custom series per host, or 200 on Enterprise. Series above that bill as overage |
| Can I filter telemetry before I pay to store it? | ✓ Yes, for metrics, logs, and traces, with no code to write. Drop, remap, redact, forward, and aggregate them at ingest, from the UI or Terraform | For metrics, on the Enterprise edition. Logs go through Edge Processor, on nodes you run |
| Are logs, metrics, and traces in one product? | ✓ Yes, on one licence, with one set of ingest rules and one place to query them | No. Logs stay on the Splunk platform, on their own licence |
| Which query languages does it use? | ✓ PromQL and LogQL, or none: build log queries in the query builder, or ask in plain English | SignalFlow and SPL, both Splunk's own. Its AI assistants write them from plain English |
| Can it run in our own cloud account? | ✓ Yes. Last9 runs in your own cloud account, on AWS or GCP in any region, and manages it for you, including the AI | No. Observability Cloud is SaaS only. Splunk Enterprise, for logs, runs on servers your team runs |
| Does it cover security analytics (SIEM)? | No. Last9 is built for observability: metrics, logs, traces, and APM | ✓ Yes. Splunk Enterprise Security, on the same platform as your logs |

## AI on your model, in your cloud

- **Last9:** One assistant in the app, in Slack, and in your IDE through MCP. It investigates, builds a diagnosis dashboard, and hands you the link.
- **Last9:** The production agent, Last9, responds to pages with context from Slack, Linear, and PagerDuty. It runs on your model provider or inference endpoint and picks the model for each step. Customer data is never used for training.
- **Last9:** Through MCP, an agent adds a drop rule and stops ingesting the noisy source it found.
- **Last9:** Click a point on a chart, a table row, an alert, or an exception, and choose Ask Last9 AI. The investigation starts from that value, in its service context.
- **Splunk:** AI SRE groups alerts into incidents and finds a likely root cause, and the AI Assistant writes SignalFlow from plain English, both in Splunk's own service, with no published option for your own model provider. Agent Observability is sold separately.

## One licence, every label, and control at ingest

- **Last9:** One licence covers distributed tracing, profiling, custom metrics, custom dashboards, alerting, RBAC, and forward deployed engineers. The infrastructure runs on your own cloud bill, at your negotiated rates.
- **Last9:** Labels like customer_id or tenant stay on the metric, with no charge per label or metric name.
- **Last9:** Drop, remap, redact, forward, and aggregate metrics, logs, and traces at ingest, from the UI or as code with the Terraform provider. Every rule is previewed against live data before you save it.
- **Splunk:** Each host carries a custom metrics entitlement, and series above it bill as overage. Metrics pipeline management drops, aggregates, or archives metrics on the Enterprise edition, with archived metrics at a tenth of the real-time price. Edge Processor shapes platform logs with SPL2 on nodes you run.
- **Matters most for:** Teams whose per-customer or per-tenant labels grow faster than their host count.

## Logs, metrics, and traces in one place, on open queries

- **Last9:** Metrics, logs, and traces in one platform, with APM built from the same OpenTelemetry data: service discovery, dependency maps, database and external calls, Apdex, exceptions, and trace correlation.
- **Last9:** PromQL and LogQL natively, with a builder and plain-English Ask Mode for anyone who does not write queries. Your own Grafana can query Last9 metrics as a Prometheus data source.
- **Last9:** Real user monitoring for web and mobile apps, and synthetic monitoring, are part of the platform.
- **Splunk:** Observability Cloud holds metrics and traces, queried in SignalFlow. Logs stay on the Splunk platform, queried in SPL or SPL2 on their own licence, and Log Observer Connect shows them next to traces.

## Your cloud account, and engineers who know it

- **Last9:** Last9 runs single-tenant in your own cloud account, on AWS or GCP in any region, and manages it for you, including the AI. Last9 sizes the cluster, tunes it, and runs the upgrades.
- **Last9:** Support is a shared channel in Slack, Microsoft Teams, or Google Chat, with forward deployed engineers who know your setup.
- **Splunk:** Observability Cloud is SaaS only, in Splunk's realms. On the platform side, Splunk Cloud Platform is SaaS too, and Splunk Enterprise runs on your own infrastructure, with your team running it.

## Which one fits your team?

**Choose Last9 if:**
- You want metrics, logs, and traces on one licence, without a separate logs contract
- You want PromQL and LogQL, or plain English, instead of SignalFlow and SPL
- Your metrics carry per-customer or per-tenant labels that outgrow a per-host entitlement
- You want the platform, including the AI, running in your own cloud account
- You want an AI agent on your own model provider, and an MCP server that can add drop rules

**Choose Splunk if:**
- You run Splunk Enterprise Security and want observability from the same vendor
- You need FedRAMP for your logs, on Splunk Cloud Platform
- Your team writes SPL every day and wants to keep it central
- You want to run the logging platform yourself, with Splunk Enterprise
- You want Cisco as the vendor, with ThousandEyes and AppDynamics alongside

## Moving off Splunk

What the switch involves, and what Last9 does for you.

- **Forward deployed engineers:** A Last9 engineer runs the move with your team.
- **Keep your instrumentation:** Splunk's distribution of the OpenTelemetry Collector is an OpenTelemetry Collector, so services instrumented with OpenTelemetry need only an OTLP exporter pointed at Last9. Prometheus and vmagent are accepted the same way.
- **Queries without SignalFlow or SPL:** A Last9 engineer moves your dashboards and alerts with your team, and rewrites SignalFlow and SPL queries in PromQL or LogQL. Anyone who does not write queries uses the builder or plain-English Ask Mode.
- **Run both:** Keep Splunk for security analytics. The OpenTelemetry Collector can send the same data to both platforms while you compare them on your own incidents.

## The objections we hear most

Each one is a fair reason to hesitate.

### Our security team already runs Splunk for logs.

Keep it for security. Enterprise Security and the logs it needs stay on the Splunk platform, and the OpenTelemetry Collector sends your observability data to Last9 as well. Your SRE team gets metrics, logs, and traces on one licence, in your own cloud account.

### Splunk already has an AI SRE, an AI Assistant, and MCP servers.

In Observability Cloud they run in Splunk's own service, with no published option for your own model provider, AI SRE has no published price, and the MCP servers' built-in tools query and search. The Last9 agent is generally available and runs on your model provider in your own cloud account, with no per-investigation charge, and through MCP an agent adds drop rules and edits dashboards.

### Our team writes SPL every day.

SPL is a strong search language, and it runs only on Splunk. Last9 answers PromQL and LogQL, which other tools run too, and anyone who does not write queries uses the builder or plain-English Ask Mode. A Last9 engineer rewrites your SignalFlow and SPL queries with your team.

### We need FedRAMP.

Splunk Cloud Platform holds FedRAMP Moderate and High authorizations, and Splunk Observability Cloud is listed as FedRAMP In Process. Last9 does not hold FedRAMP. It is SOC 2 Type II certified and PCI ready, with SSO and access controls, and it runs in your own cloud account.

### Is Last9 proven at our scale?

Last9 regularly handles 500M+ events a minute and 60M+ concurrent users, and has monitored 12 of the world's 20 largest streaming events. It is SOC 2 Type II certified and PCI ready, with SSO and access controls. Teams across fintech, healthcare, gaming, media, and commerce run it in production, including Replit, Pine Labs, Tata 1mg, and Housing.com.

## FAQ

### Is Last9 a good Splunk alternative?

Splunk fits teams that run Enterprise Security, need FedRAMP for their logs, or write SPL every day. Last9 fits teams that want metrics, logs, and traces on one licence in their own cloud account, PromQL and LogQL instead of SignalFlow and SPL, and an AI agent on their own model provider.

### How does Last9's MCP server compare with the Splunk MCP server?

Splunk has had MCP servers since July 2025: a hosted one for Observability Cloud and an app for the Splunk platform. Their built-in tools query metrics, traces, alerts, and SPL searches, and writes need custom tools that an admin builds. Last9's MCP server is hosted, since March 2025, and lets an agent add drop rules and edit dashboards, so it can change what is ingested.

### How does Last9's AI compare with Splunk AI?

Splunk AI in Observability Cloud includes AI SRE, generally available since June 2026 with no published price, and an AI Assistant that writes SignalFlow, both in Splunk's own service. Agent Observability is a separate SKU. The Last9 agent is generally available, runs on your model provider inside your own cloud account, and has no per-query or per-investigation charge.

### How does Last9 billing compare with Splunk pricing?

Splunk pricing for Observability Cloud is per host, in three tiers that add APM, then RUM and browser synthetics, with logs on a separate Splunk platform licence. Last9 is one licence that covers tracing, profiling, custom metrics, dashboards, alerting, RBAC, and forward deployed engineers, with the infrastructure on your own cloud bill.

### How does Last9 compare with SignalFx?

SignalFx is now Splunk Observability Cloud, where each host includes 100 custom metric time series, or 200 on Enterprise, and series above that bill as overage. Last9 has no hard limit on metric cardinality: 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name.

### What does Last9 use instead of the Splunk query language?

The Splunk query language, SPL, runs logs searches on the Splunk platform, and SignalFlow runs metrics and detectors in Observability Cloud. Both run only on Splunk. Last9 answers PromQL and LogQL, and anyone who does not write queries uses the builder or plain-English Ask Mode.

### Is there a Splunk Enterprise alternative that runs in our cloud account?

Splunk Enterprise runs on your own infrastructure, and your team installs, runs, and upgrades it, while Splunk Observability Cloud is SaaS only. Last9 runs single-tenant in your own cloud account, on AWS or GCP in any region, and Last9 manages it for you, including the AI.

### Can Last9 replace Splunk APM?

Splunk APM builds service maps and trace analytics from OpenTelemetry data, on the App & Infra and End-to-End tiers. Last9 covers service discovery, dependency maps, database and external calls, Apdex, exceptions, and trace correlation, from OpenTelemetry, on the one licence, with real user monitoring and synthetic monitoring in the same platform.

### Can Last9 run alongside Splunk?

Yes. Splunk's collector is an OpenTelemetry Collector, so it can send the same data to both. Teams keep Splunk for security analytics, and a Last9 engineer plans the split with your team.

### How do I migrate from Splunk to Last9?

Services instrumented with OpenTelemetry need only an OTLP exporter pointed at Last9, and Prometheus and vmagent sources need a new endpoint. A Last9 engineer moves your dashboards and alerts with your team, and rewrites SignalFlow and SPL queries in PromQL or LogQL.