Splunk → OpenSearch
What it saves, what actually moves, what you rebuild — and the thing that catches people.
What it costs, and what it saves
Splunk prices by daily ingest volume and enterprise agreements routinely reach six figures. OpenSearch is Apache-2.0 and free; you pay for the cluster. A 100GB/day estate that costs tens of thousands annually on Splunk runs on hardware in the low thousands.
Moves cleanly
Raw log data, if you still have the sources. Splunk's indexed data is not portable — you re-ingest from origin.
You rebuild
Every SPL search, dashboard and alert. SPL and OpenSearch DSL are entirely different languages and this is the bulk of the work.
What Splunk costs you today
Ingest- and workload-based pricing (historically per GB/day indexed, now Splunk Cloud workload/ingest tiers). Widely regarded as one of the most expensive options at high data volumes, which is the main driver people cite for looking elsewhere.
What actually holds you in
Splunk's SPL query language, saved searches, and app ecosystem are proprietary, so dashboards and detections do not port; combined with data gravity at scale, that is the real switching cost — not the raw log format.
What you are moving to
OpenSearch is a community-driven fork of Elasticsearch and Kibana, kept under the Apache-2.0 license. It ingests, indexes, and searches logs and events at scale, with dashboards and a security-analytics plugin for SIEM use — the closest open feature parity to Splunk's core.
Free / self-host; managed options available from AWS and others
OpenSearch strengths
- Truly open (Apache-2.0), no source-available or field-of-use restrictions
- Closest feature parity to Splunk — search, dashboards, and a SIEM plugin
- Large ecosystem inherited from the Elasticsearch/Kibana lineage
What you give up
- Cluster operations (sharding, JVM tuning) have a real learning curve
- Resource-hungry at large data volumes
- Different query language — not a drop-in for Splunk's SPL
The migration, step by step
- 1Inventory which SPL searches are actually used — instrument Splunk's own audit logs for 30 days first
- 2Stand up OpenSearch with dedicated master, data and coordinating nodes; do not run a single-node cluster in production
- 3Point new log sources at OpenSearch via Fluent Bit or Logstash and let both run
- 4Port only the searches your audit showed were run, translating SPL to DSL by hand
- 5Set up ISM policies for index rollover before you have a disk incident, not after
The gotcha
Splunk users underestimate how much SPL they have. The audit-log inventory in step one is the difference between a three-month project and a nine-month one, and almost nobody does it.
When to stay on Splunk
You are in a regulated environment where Splunk holds a specific compliance attestation, or your SOC runs on Splunk Enterprise Security — that has no open equivalent.
More Layer 3 migrations
Figures verified 2026-07-09 against vendor pricing pages. Prices change and migrations differ by estate — treat the cost delta as a starting model, not a quote. Rankings and recommendations here are merit-only; affiliate income never changes a verdict. See our methodology.