Dynatrace vs Splunk
Dynatrace and Splunk are both evaluated in the CIOPages Log Management & Analysis Buyer's Guide. The guide groups Dynatrace under Observability Suite and Splunk under SIEM-Led.
| Attribute | Dynatrace | Splunk (Cisco) |
|---|---|---|
| Approach | Observability Suite | SIEM-Led |
| Best for | Enterprises standardizing on Dynatrace for full-stack observability who want AI-assisted log analytics in one platform | Large enterprises and SOC teams that need the deepest log analytics with security and compliance at the center |
From the Log Management & Analysis Buyer's Guide, updated June 2026. 8 vendors evaluated.
Dynatrace
Schema-on-read, with the AI doing the first pass: log management built on Grail, a data lakehouse that ingests logs without up-front indexing and queries them with DQL, unified with Dynatrace metrics, traces, and topology and enriched by Davis AI for automated anomaly detection and root-cause, with a “Retain with Included Queries” option holding data at a fixed cost with bounded querying over shorter retention windows for predictability. The greatest value comes from adopting the wider Dynatrace platform; as a standalone log tool it is a less natural fit, and DQL plus the DPS consumption model is a learning curve. Pricing has several consumption dimensions — ingest, retention, query — to model, and this is typically a premium, platform-level commitment rather than a tactical log purchase.
Splunk (Cisco)
The most mature enterprise log platform, and priced accordingly: the deepest query language in SPL, a vast app and integration ecosystem, and the strongest security analytics and SIEM story in the category, with Cisco ownership since the deal closed in March 2024 adding network telemetry and a path to tie logs into the broader Cisco security and observability portfolio, and workload SVC pricing offering an alternative to pure per-GB ingest for estates full of rarely-searched data. It sits at the premium end on cost, and licensing is genuinely complex — ingest versus workload pricing is a decision in itself. Deployment and tuning reward certified expertise, migrating a large on-prem estate to Splunk Cloud is a real project, and how Cisco continues to integrate and package the portfolio is worth tracking.
Also evaluated in this guide
Cribl, Datadog Log Management, Elastic, Grafana Loki, Microsoft Sentinel, Sumo Logic
Related comparisons
Editors choose the vendors and write the evaluations. Paying CIOPages does not change how a vendor is covered. Editorial policy