Start free inside your own Splunk. Pay when it earns its place.
Pricing that scales with you, not against you. Start free inside your own Splunk, and only pay once it’s earning its keep — Professional is priced in the open, Enterprise and MSP we shape around what you run. All prices exclude VAT.
Personal
- 1 user · 1 Org · 1 BU
- SPL, dashboard & alert generation
- Bring your own LLM · multi-provider
- Knowledge, Skills & Templates
- Data-quality ingestion checks
Professional
- Everything in Personal
- Unlimited users · up to 3 BUs
- ML generation (MLTK)
- History + Tokens & Costs
- Backups & Data Onboarding
- Optional: Ops runbooks · ServiceNow ITSM (REST & MCP)
Enterprise
- Everything in Professional
- Security workflows (ES / ITSI / ATT&CK)
- MCP servers & custom HTTP tools
- Audit & governance logging
- Reliability: failover, AI-Activity & LLM-Health
- Optional: SOC playbooks
MSP
- Everything in Enterprise
- Unlimited Orgs & BUs
- Multi-environment: one key, many deployments
- Per-environment isolation
- Configurable white-label badge
Compare editions
Every edition runs inside your Splunk, under your roles, on the LLM you choose. Higher tiers inherit everything below. A few capabilities are optional add-ons you can switch on per license.
| Capability | Personal | Professional | Enterprise | MSP |
|---|---|---|---|---|
| Scale & mechanics | ||||
| Users | 1 | Unlimited | Unlimited | Unlimited |
| Organizations | 1 | 1 | 1 | Unlimited |
| Business Units per Org | 1 | 3 | Unlimited | Unlimited |
| Multiple Splunk environments | — | — | — | ✓ |
| Core generation — all tiers | ||||
| SPL, dashboard & alert generation | ✓ | ✓ | ✓ | ✓ |
| Bring your own LLM · multi-provider | ✓ | ✓ | ✓ | ✓ |
| Knowledge, Skills & Template authoring | ✓ | ✓ | ✓ | ✓ |
| Data-quality ingestion checks (TrackMe / Cribl) — incl. free | ✓ | ✓ | ✓ | ✓ |
| Operations — Professional+ | ||||
| ML generation (MLTK fit / CDTSM) | — | ✓ | ✓ | ✓ |
| History | — | ✓ | ✓ | ✓ |
| Tokens & Costs | — | ✓ | ✓ | ✓ |
| Backups & content-pack import | — | ✓ | ✓ | ✓ |
| Data Onboarding & Quality Score | — | ✓ | ✓ | ✓ |
| Live model & cost discovery | — | ✓ | ✓ | ✓ |
| Unattended automation — Backend Ask Serviceruns from alert / ES / ITSI / schedule | — | ✓ | ✓ | ✓ |
| Content pack delivery (no app release) | — | ✓ | ✓ | ✓ |
| Operations runbooks | — | Optional | Optional | Optional |
| ServiceNow integration — Professional+ add-on | ||||
| ITSM read & CMDB/CSDM traversal | — | Optional | Optional | Optional |
| Incident & event create / update | — | ✓ | ✓ | ✓ |
| Security incidents — SIRadmin opt-in ¹ | — | Optional | Optional | Optional |
| ServiceNow via MCP transport | — | Optional | Optional | Optional |
| Security, integrations & governance — Enterprise+ | ||||
| Security workflows (ES / ITSI / ATT&CK / SSE) | — | — | ✓ | ✓ |
| SOC playbooks | — | — | Optional | Optional |
| MCP servers | — | — | ✓ | ✓ |
| Inbound MCP server — registers into Splunk’s own MCP Serverother agents can drive Adjutant playbooks | — | — | ✓ | ✓ |
| Custom HTTP tools | — | — | ✓ | ✓ |
| Customer IAM gateway hook | — | — | ✓ | ✓ |
| Audit logging | — | — | ✓ | ✓ |
| Governance change-log mirror | — | — | ✓ | ✓ |
| Model catalog overrides | — | — | ✓ | ✓ |
| Agent telemetry — Enterprise+ | ||||
| Agent Telemetry & OCSF exportSOC watches the agent · off by default | — | — | ✓ | ✓ |
| Behaviour (OCSF) dashboard + policy-refusal feed | — | — | ✓ | ✓ |
| Reliability & observability — Enterprise+ | ||||
| Failover / circuit-breaker / retry | — | — | ✓ | ✓ |
| AI-Activity dashboard | — | — | ✓ | ✓ |
| LLM-Health dashboard | — | — | ✓ | ✓ |
| Support | ||||
| Support | Community | Standard | Premium + SLA | Premium + SLA |
Runs on Splunk Enterprise 9.x LTS through 10.4 · dual Python 3.9 / 3.13 · Splunkbase Cloud vetted · on-prem, no cloud egress.
Optional capabilities are licensed add-ons switched on per key at or above the tier shown — they are not included by default. ¹ ServiceNow SIR (security incidents) additionally requires an explicit per-Org admin opt-in and is off by default. Higher tiers inherit every included capability below them. All prices exclude VAT. Enterprise and MSP are tailored to your estate — talk to us. A 30-day Proof of Value with agreed success criteria is the fastest way to evaluate.