Why engineering teams choose Last9 vs Splunk
Both have an AI SRE agent and an MCP server. Last9 runs its agent on your model provider, with no charge per investigation, inside your own cloud account, on one licence for metrics, logs, and traces. Splunk splits them: Observability Cloud holds metrics and traces, priced per host, and logs stay on the Splunk platform, next to its SIEM.
100+ native integrations, OpenTelemetry-first. A Last9 engineer runs the move with your team.
Named a Gartner® Cool Vendor in AI for SRE and Observability, cited for its unified telemetry platform.
The Last9 agent runs on your model provider, with no per-investigation charge, in your own cloud account.
Metrics, logs, and traces on one licence, with no charge per label or metric name. The infrastructure runs on your own cloud bill.
At a glance
Last9 vs Splunk at a glance
The questions engineering teams ask when they compare the two. Splunk Observability Cloud is the product compared here, with the Splunk platform named where logs, deployment, and security are concerned.
Does it have an MCP server for coding agents?
Yes, hosted, since March 2025, for any MCP client. An agent can act through it: add drop rules and edit dashboards
Yes, since July 2025. Its built-in tools query and search. Writes need custom tools that an admin builds
What does the AI cost?
No per-query or per-investigation charge. The Last9 agent is generally available, in the app, in Slack, and in your IDE
No published price for AI SRE. Agent Observability, for LLM apps and coding agents, is a separate SKU
Can the AI use our model provider, in our own cloud?
Yes. The Last9 agent runs on your model provider or inference endpoint, inside your own cloud account, and picks the model for each step
No published option in Observability Cloud. Its AI runs in Splunk's own service
How is it priced?
One licence. The infrastructure runs on your own cloud bill, at your negotiated rates
Per host, in three tiers. Logs need a separate Splunk platform licence
How much metric cardinality can I keep?
No hard limit. 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name
100 custom series per host, or 200 on Enterprise. Series above that bill as overage
Can I filter telemetry before I pay to store it?
Yes, for metrics, logs, and traces, with no code to write. Drop, remap, redact, forward, and aggregate them at ingest, from the UI or Terraform
For metrics, on the Enterprise edition. Logs go through Edge Processor, on nodes you run
Are logs, metrics, and traces in one product?
Yes, on one licence, with one set of ingest rules and one place to query them
No. Logs stay on the Splunk platform, on their own licence
Which query languages does it use?
PromQL and LogQL, or none: build log queries in the query builder, or ask in plain English
SignalFlow and SPL, both Splunk's own. Its AI assistants write them from plain English
Can it run in our own cloud account?
Yes. Last9 runs in your own cloud account, on AWS or GCP in any region, and manages it for you, including the AI
No. Observability Cloud is SaaS only. Splunk Enterprise, for logs, runs on servers your team runs
Does it cover security analytics (SIEM)?
No. Last9 is built for observability: metrics, logs, traces, and APM
Yes. Splunk Enterprise Security, on the same platform as your logs
| Capability | Last9 | Splunk |
|---|---|---|
| Does it have an MCP server for coding agents? | Yes, hosted, since March 2025, for any MCP client. An agent can act through it: add drop rules and edit dashboards | Yes, since July 2025. Its built-in tools query and search. Writes need custom tools that an admin builds |
| What does the AI cost? | No per-query or per-investigation charge. The Last9 agent is generally available, in the app, in Slack, and in your IDE | No published price for AI SRE. Agent Observability, for LLM apps and coding agents, is a separate SKU |
| Can the AI use our model provider, in our own cloud? | Yes. The Last9 agent runs on your model provider or inference endpoint, inside your own cloud account, and picks the model for each step | No published option in Observability Cloud. Its AI runs in Splunk's own service |
| How is it priced? | One licence. The infrastructure runs on your own cloud bill, at your negotiated rates | Per host, in three tiers. Logs need a separate Splunk platform licence |
| How much metric cardinality can I keep? | No hard limit. 20M series per metric per day by default, raised on request, with no sampling and no charge per label or metric name | 100 custom series per host, or 200 on Enterprise. Series above that bill as overage |
| Can I filter telemetry before I pay to store it? | Yes, for metrics, logs, and traces, with no code to write. Drop, remap, redact, forward, and aggregate them at ingest, from the UI or Terraform | For metrics, on the Enterprise edition. Logs go through Edge Processor, on nodes you run |
| Are logs, metrics, and traces in one product? | Yes, on one licence, with one set of ingest rules and one place to query them | No. Logs stay on the Splunk platform, on their own licence |
| Which query languages does it use? | PromQL and LogQL, or none: build log queries in the query builder, or ask in plain English | SignalFlow and SPL, both Splunk's own. Its AI assistants write them from plain English |
| Can it run in our own cloud account? | Yes. Last9 runs in your own cloud account, on AWS or GCP in any region, and manages it for you, including the AI | No. Observability Cloud is SaaS only. Splunk Enterprise, for logs, runs on servers your team runs |
| Does it cover security analytics (SIEM)? | No. Last9 is built for observability: metrics, logs, traces, and APM | Yes. Splunk Enterprise Security, on the same platform as your logs |
Differences
Where Last9 and Splunk differ
Three places the two platforms take a different approach, with the tradeoffs stated.
AI on your model, in your cloud
-
One assistant in the app, in Slack, and in your IDE through MCP. It investigates, builds a diagnosis dashboard, and hands you the link.
-
The production agent, Last9, responds to pages with context from Slack, Linear, and PagerDuty. It runs on your model provider or inference endpoint and picks the model for each step. Customer data is never used for training.
-
Through MCP, an agent adds a drop rule and stops ingesting the noisy source it found.
-
Click a point on a chart, a table row, an alert, or an exception, and choose Ask Last9 AI. The investigation starts from that value, in its service context.
Splunk
AI SRE groups alerts into incidents and finds a likely root cause, and the AI Assistant writes SignalFlow from plain English, both in Splunk's own service, with no published option for your own model provider. Agent Observability is sold separately.
One licence, every label, and control at ingest
-
One licence covers distributed tracing, profiling, custom metrics, custom dashboards, alerting, RBAC, and forward deployed engineers. The infrastructure runs on your own cloud bill, at your negotiated rates.
-
Labels like customer_id or tenant stay on the metric, with no charge per label or metric name.
-
Drop, remap, redact, forward, and aggregate metrics, logs, and traces at ingest, from the UI or as code with the Terraform provider. Every rule is previewed against live data before you save it.
Splunk
Each host carries a custom metrics entitlement, and series above it bill as overage. Metrics pipeline management drops, aggregates, or archives metrics on the Enterprise edition, with archived metrics at a tenth of the real-time price. Edge Processor shapes platform logs with SPL2 on nodes you run.
Matters most for
Teams whose per-customer or per-tenant labels grow faster than their host count.
Logs, metrics, and traces in one place, on open queries
-
Metrics, logs, and traces in one platform, with APM built from the same OpenTelemetry data: service discovery, dependency maps, database and external calls, Apdex, exceptions, and trace correlation.
-
PromQL and LogQL natively, with a builder and plain-English Ask Mode for anyone who does not write queries. Your own Grafana can query Last9 metrics as a Prometheus data source.
-
Real user monitoring for web and mobile apps, and synthetic monitoring, are part of the platform.
Splunk
Observability Cloud holds metrics and traces, queried in SignalFlow. Logs stay on the Splunk platform, queried in SPL or SPL2 on their own licence, and Log Observer Connect shows them next to traces.
Your cloud account, and engineers who know it
-
Last9 runs single-tenant in your own cloud account, on AWS or GCP in any region, and manages it for you, including the AI. Last9 sizes the cluster, tunes it, and runs the upgrades.
-
Support is a shared channel in Slack, Microsoft Teams, or Google Chat, with forward deployed engineers who know your setup.
Splunk
Observability Cloud is SaaS only, in Splunk's realms. On the platform side, Splunk Cloud Platform is SaaS too, and Splunk Enterprise runs on your own infrastructure, with your team running it.
Which fits you
Which one fits your team?
Choose Last9 if
- You want metrics, logs, and traces on one licence, without a separate logs contract
- You want PromQL and LogQL, or plain English, instead of SignalFlow and SPL
- Your metrics carry per-customer or per-tenant labels that outgrow a per-host entitlement
- You want the platform, including the AI, running in your own cloud account
- You want an AI agent on your own model provider, and an MCP server that can add drop rules
Choose Splunk if
- You run Splunk Enterprise Security and want observability from the same vendor
- You need FedRAMP for your logs, on Splunk Cloud Platform
- Your team writes SPL every day and wants to keep it central
- You want to run the logging platform yourself, with Splunk Enterprise
- You want Cisco as the vendor, with ThousandEyes and AppDynamics alongside
Migration
Moving off Splunk
What the switch involves, and what Last9 does for you.
Forward deployed engineers
A Last9 engineer runs the move with your team.
Talk to an engineerKeep your instrumentation
Splunk's distribution of the OpenTelemetry Collector is an OpenTelemetry Collector, so services instrumented with OpenTelemetry need only an OTLP exporter pointed at Last9. Prometheus and vmagent are accepted the same way.
See the integrationsQueries without SignalFlow or SPL
A Last9 engineer moves your dashboards and alerts with your team, and rewrites SignalFlow and SPL queries in PromQL or LogQL. Anyone who does not write queries uses the builder or plain-English Ask Mode.
Run both
Keep Splunk for security analytics. The OpenTelemetry Collector can send the same data to both platforms while you compare them on your own incidents.
Objections
The objections we hear most
Each one is a fair reason to hesitate.
Our security team already runs Splunk for logs.
Keep it for security. Enterprise Security and the logs it needs stay on the Splunk platform, and the OpenTelemetry Collector sends your observability data to Last9 as well. Your SRE team gets metrics, logs, and traces on one licence, in your own cloud account.
Splunk already has an AI SRE, an AI Assistant, and MCP servers.
In Observability Cloud they run in Splunk's own service, with no published option for your own model provider, AI SRE has no published price, and the MCP servers' built-in tools query and search. The Last9 agent is generally available and runs on your model provider in your own cloud account, with no per-investigation charge, and through MCP an agent adds drop rules and edits dashboards.
Our team writes SPL every day.
SPL is a strong search language, and it runs only on Splunk. Last9 answers PromQL and LogQL, which other tools run too, and anyone who does not write queries uses the builder or plain-English Ask Mode. A Last9 engineer rewrites your SignalFlow and SPL queries with your team.
We need FedRAMP.
Splunk Cloud Platform holds FedRAMP Moderate and High authorizations, and Splunk Observability Cloud is listed as FedRAMP In Process. Last9 does not hold FedRAMP. It is SOC 2 Type II certified and PCI ready, with SSO and access controls, and it runs in your own cloud account.
Is Last9 proven at our scale?
Last9 regularly handles 500M+ events a minute and 60M+ concurrent users, and has monitored 12 of the world's 20 largest streaming events. It is SOC 2 Type II certified and PCI ready, with SSO and access controls. Teams across fintech, healthcare, gaming, media, and commerce run it in production, including Replit, Pine Labs, Tata 1mg, and Housing.com.
67%
Average reduction in observability costs
2.5x
More telemetry retained without sampling
100+
Native integrations, OpenTelemetry-first
24x7
Support from forward deployed engineers
Customers
What do Last9 customers say?
With Last9, we just eliminated the toil. No more worrying about failing dashboards or alerts — we can finally use our metrics. It just works.
Last9 allowed us to offload the operational overhead of scaling so we could focus on business alerting rather than infrastructure management.
Frequently asked questions
Ask AI about this comparison
Do not take our word for it. Send the question to an assistant and check what it finds.
Can't find the answer to your question?
Talk to our support team for help.
Start observing for free. No lock-in.
OpenTelemetry · Prometheus
Just update your config. Start seeing data on Last9 in seconds.
Datadog · New Relic · Others
We've got you covered. Bring over your dashboards & alerts in one click.
Built on Open Standards
100+ integrations. OTel native, works with your existing stack.
