OpenSearch vs SigNoz
Both are free/open-source alternatives to Splunk. Here's how they stack up — verified facts, no spin.
OpenSearch
TOP PICKThe Apache-2.0 search and log-analytics platform (the Elasticsearch fork).
OpenSearch is a community-driven fork of Elasticsearch and Kibana, kept under the Apache-2.0 license. It ingests, indexes, and searches logs and events at scale, with dashboards and a security-analytics plugin for SIEM use — the closest open feature parity to Splunk's core.
SigNoz
OpenTelemetry-native logs, traces, and metrics in one app.
SigNoz ingests logs alongside traces and metrics via OpenTelemetry and provides search, dashboards, and alerting. It fits best when your log analysis sits next to application observability rather than dedicated security/SIEM work.
Side by side
| OpenSearch | SigNoz | |
|---|---|---|
| Sovereignty Score | 88 | 84 |
| Open source | Yes | Yes |
| Self-hostable | Yes | Yes |
| Local-first | Yes | Yes |
| License | Apache-2.0 | MIT (core) |
| Pricing | Free / self-host; managed options available from AWS and others | Free / self-host; optional managed cloud |
OpenSearch is Macrostack's recommended Splunk alternative, so it's our pick here.
OpenSearch
Strengths
- +Truly open (Apache-2.0), no source-available or field-of-use restrictions
- +Closest feature parity to Splunk — search, dashboards, and a SIEM plugin
- +Large ecosystem inherited from the Elasticsearch/Kibana lineage
Trade-offs
- −Cluster operations (sharding, JVM tuning) have a real learning curve
- −Resource-hungry at large data volumes
- −Different query language — not a drop-in for Splunk's SPL
SigNoz
Strengths
- +Unifies logs with traces and metrics via OpenTelemetry
- +MIT-licensed core, no field-of-use restrictions
- +No per-GB-ingest billing when self-hosted
Trade-offs
- −Log analytics is younger than OpenSearch's search engine
- −Not a SIEM — no dedicated security-analytics layer
- −ClickHouse-backed stack to operate
More Splunk head-to-heads
Facts verified 2026-07-09. Licenses and pricing change — spotted something out of date? That's a correction we want.