Datadog, Splunk Observability Cloud, and New Relic land within 15 percent of each other on sticker price for a 500-host estate, but realised cost diverges by 60 to 200 percent once ingestion patterns, retention, and user counts come into the model. Datadog charges per host plus per-feature add-ons. Splunk charges per ingested gigabyte. New Relic charges per ingested gigabyte plus per-user. The vendor that wins on a 100-host workload loses badly on a 5,000-host estate, and the vendor that wins on debug logging loses on metrics. This comparison sets the decision framework by workload pattern, with 2026 pricing math.
Headline pricing for 2026
All three vendors publish list pricing. Realised pricing differs materially from list at commit volumes above $250,000 annual contract value.
| Capability | Datadog | Splunk O11y Cloud | New Relic |
|---|---|---|---|
| Infrastructure monitoring | $15 to $34 per host per month | $15 per host per month | $0.30 per GB ingested |
| APM | $31 to $36 per host per month | $60 per host per month | Included in ingest cost |
| Log management | $0.10 per GB ingest + $1.27 per million events retained | $2.50 per GB ingested | $0.35 per GB ingested |
| Real user monitoring | $1.50 per 1k sessions | $14 per 1k sessions | Per session in ingest model |
| Synthetic monitoring | $5 per 10k API tests | $1 per 10k tests | $0.0025 per check |
| Database monitoring | $70 per database host per month | Not a separate SKU | Per ingest GB |
| Cloud SIEM | $0.20 per GB | $2.40 per GB (separate Splunk Enterprise Security) | $0.35 per GB |
| User seat (full platform) | Bundled | Per-user not metered | $99 to $499 per user per month |
The list comparison is misleading without a workload model. The next four sections build that model for the four most common enterprise observability patterns.
Pattern one: 500-host steady production
The most common enterprise pattern is a 500-host production estate with full-stack monitoring (infrastructure plus APM plus logs at 50 GB per host per month). Three-year TCO modelling:
| Cost line | Datadog | Splunk O11y | New Relic |
|---|---|---|---|
| Infra monitoring 500 hosts | $153,000 per year | $90,000 per year | Ingest-based |
| APM 500 hosts | $186,000 per year | $360,000 per year | Ingest-based |
| Logs 25 TB per year | $30,720 ingest + $32,000 retention | $640,000 | $87,500 |
| Database monitoring 100 DB hosts | $84,000 | Included | Included |
| Platform users 50 | $0 (bundled) | $0 | $59,400 (50 × $99) |
| Annual list TCO | $485,720 | $1,090,000 | $146,900 |
| Negotiated (20 to 35 percent off) | $316,000 to $389,000 | $709,000 to $872,000 | $95,000 to $117,000 |
New Relic wins on this workload by a wide margin because the volume of logs is modest and the user count is low. Datadog wins on operational signal density and ecosystem breadth. Splunk loses on raw cost because Splunk Observability Cloud inherited Splunk Enterprise's per-GB instinct and the per-GB ingestion fees dominate the bill.
Pattern two: log-heavy SaaS estate
A SaaS company ingesting 200 TB of logs per year for compliance and forensic retention, with only 200 hosts under metric monitoring:
| Cost line | Datadog | Splunk O11y | New Relic |
|---|---|---|---|
| Infra 200 hosts | $61,200 | $36,000 | Ingest only |
| Logs 200 TB per year | $245,000 ingest + $256,000 retention | $5,120,000 | $700,000 |
| APM 200 hosts | $74,400 | $144,000 | Included |
| Users 40 | $0 | $0 | $47,520 |
| Annual list TCO | $636,600 | $5,300,000 | $747,520 |
Splunk Observability Cloud's per-GB log pricing makes high-volume log workloads economically untenable on list. Even at 50 percent discount, Splunk lands at $2.65M against Datadog at $414,000. For pure-log compliance ingestion, the cheapest option is often to drop Splunk Observability altogether and route logs to S3 or Azure Blob via a Kinesis or Event Hubs pipeline, paying $50,000 a year in storage and querying with Athena or Kusto on demand.
The cardinality trap: Datadog's metric pricing includes 100 custom metrics per host. Above that, custom metrics cost $5 per 100 metrics per month per host. Kubernetes estates with labels that include pod name or request ID can blow through cardinality limits and add $200,000 to $500,000 per year to a Datadog bill before any feature add-on. Cardinality control is the single highest-discount Datadog cost optimisation, ahead of host count negotiation.
Pattern three: high-density Kubernetes workload
A Kubernetes estate with 100 underlying VMs but 2,500 pods generates the cardinality problem above. Datadog historically counted each pod as a billable host until pricing changes capped pod billing at 5x the node count. Splunk and New Relic price differently:
| Cost line | Datadog | Splunk O11y | New Relic |
|---|---|---|---|
| Node billing (100 VMs) | $30,600 infra + $37,200 APM | $18,000 + $72,000 | Per ingest only |
| Container billing | Up to 5 containers free per host, then $1 per extra container per month | Bundled into per-host | Bundled into ingest GB |
| Custom metrics (cardinality) | $5 per 100 metrics over 100/host | $0.10 per MTS per month over allotment | Per ingest GB |
| Logs from pods 30 TB per year | $36,864 + $38,400 retention | $768,000 | $105,000 |
| Annual list TCO | $210,000 to $360,000 depending on cardinality | $880,000+ | $120,000 to $180,000 |
For Kubernetes-heavy workloads, New Relic's ingest model is structurally cheaper when log volume is the dominant cost. Datadog wins when metrics and APM dominate. Splunk Observability rarely wins this workload pattern unless the buyer already has a Splunk Enterprise estate and bundles for cross-license discount.
Pattern four: observability plus SIEM convergence
The 2024 to 2026 vendor consolidation push moves SIEM workloads into the observability tools. The pricing math:
| SIEM-relevant capability | Datadog Cloud SIEM | Splunk Enterprise Security | New Relic |
|---|---|---|---|
| Ingest pricing | $0.20 per GB | $2.40 per GB indexed | $0.35 per GB |
| Retention | $1.27 per million events for 15 months | Included in ingest | $0.05 per GB per month archival |
| Threat content | 500+ out-of-box rules | 5,000+ rules and ES Content Updates | Limited threat content |
| Investigation UX | Workflow Hub | Splunk SOAR included in Premium | Errors Inbox |
| Realistic 200 TB SIEM estate | $80,000 plus $400,000 retention | $1.6M to $2.4M (Splunk ES) | $80,000 ingest, limited SIEM fit |
Datadog Cloud SIEM is cheaper than Splunk Enterprise Security by a factor of 5 to 10, but Splunk ES still leads on content depth, compliance reporting templates, and analyst workflow. The decision is between cost discipline (Datadog) and SOC maturity (Splunk). New Relic is not a credible SIEM choice for regulated industries in 2026.
Negotiation framework by vendor
The negotiation levers differ by vendor because the pricing models differ. The buyer should match the lever to the vendor.
Datadog negotiation levers
Datadog signs annual commits with discount bands roughly at $250k, $500k, $1M, $3M, and $10M annual contract value. The discount bands at the lower end are 5 to 15 percent. The $1M-plus band moves to 20 to 30 percent. The $10M-plus band moves to 35 to 50 percent. Multi-year terms add 5 to 10 percentage points. The most overlooked Datadog lever is the SKU-by-SKU negotiation: Database Monitoring, Network Performance Monitoring, and Workflow Automation each carry separate list prices, and Datadog will discount the add-ons more aggressively than the core platform if the platform commit is already large.
Splunk negotiation levers
Splunk's pricing has shifted under Cisco ownership. Ingest discounts of 30 to 50 percent are realistic on $1M-plus commits. Splunk's Workload Pricing model (introduced 2020, expanded under Cisco) breaks the pure per-GB lock and prices by infrastructure plus user count instead. Negotiating onto Workload Pricing can reduce effective cost 25 to 40 percent for log-heavy estates. The Cisco cross-portfolio bundle (Splunk plus Webex plus Catalyst Center) is the highest-discount Cisco-era discount, opening 30 to 45 percent on Splunk if the wider Cisco estate is large.
New Relic negotiation levers
New Relic's per-ingest-GB plus per-user model creates a buyer-side advantage: the user count is fully controllable. Many enterprises over-provision New Relic users because the platform is free for read-only access. Auditing actual user activity and reducing paid full-platform users from 60 to 25 saves $35,000 a year on list. The ingest-GB rate itself is negotiable on $500k-plus commits, with 20 to 35 percent discount realistic.
Decision framework by workload
The buyer-side decision tree:
| Workload pattern | Winner on cost | Winner on capability |
|---|---|---|
| Steady production 500 hosts, modest logs | New Relic | Datadog |
| Log-heavy compliance estate | Datadog or external object store | Splunk for SIEM, Datadog for ops |
| Kubernetes-heavy with high cardinality | New Relic on raw cost | Datadog with cardinality discipline |
| SIEM plus observability convergence | Datadog | Splunk Enterprise Security |
| Sub-200 host startup | New Relic free tier | Datadog or Grafana Cloud |
| 5,000+ host global enterprise | Negotiated Datadog or split-vendor | Datadog at scale |
The split-vendor pattern is increasingly common at scale: Datadog for metrics and APM, Grafana Cloud or open-source Prometheus for low-value monitoring, Splunk for SIEM, S3 plus Athena for cold log retention. The administrative cost of running three platforms is offset by 40 to 60 percent reduction in total observability spend.
The OpenTelemetry hedge: All three vendors now ingest OpenTelemetry-formatted data. Standardising your application instrumentation on OpenTelemetry rather than vendor-specific agents preserves the option to switch vendors at renewal without re-instrumenting. This is the highest-discount 2026 architectural decision for observability cost control.
Exit cost and switching economics
The cost of switching observability vendors is dominated by re-instrumentation, dashboard migration, and operational disruption, not by software cost. Typical switching cost for a 500-host estate is $400,000 to $900,000 across professional services, internal effort, and parallel-run period. The exception is OpenTelemetry-instrumented estates, where switching is largely a configuration change.
Splunk to Datadog migrations are the most common pattern in 2026, driven by post-Cisco price increases and the integrated APM proposition. Datadog to New Relic migrations are rarer but rising as New Relic's ingest pricing becomes attractive at scale. New Relic to Datadog migrations are typically driven by feature breadth rather than cost.
The fastest path to verified cost reduction across any of these platforms starts with a free baseline review. Our advisors have run 80-plus observability cost reviews across Datadog, Splunk, and New Relic estates between 2024 and 2026, with a median identified saving of 32 percent of annual observability spend. See Datadog negotiation playbook, cloud cost optimisation framework, observability licensing reference, data platform comparison, and Microsoft Sentinel pricing 2026. For a structured assessment, see our cloud contract negotiation service, our software licensing advisory, or visit the AWS vendor hub for hyperscaler-side commercial framing.