Splunk vs Wazuh vs ELK: which SIEM fits your budget.

Ask three security engineers which SIEM to buy and you will get three answers, delivered with the same certainty, for three completely different reasons. That is because "SIEM" is doing a lot of work as a label. Splunk, Wazuh, and the ELK / Elastic Stack all promise to centralize your logs and help you catch bad things happening on your network — but they are built on opposite assumptions about who is paying, who is operating the thing, and how much in-house expertise is available to keep it running. Comparing them on features alone misses the point. Comparing them on cost model and team fit is the comparison that actually survives a budget review.

Quick verdict

How they actually differ

Splunk is commercial software, and its pricing model is the single most consequential fact about it: you are licensed primarily by the volume of data you ingest per day, not by seats or hosts. That model scales beautifully when you are small and painfully once you are not — a few extra debug-level log sources, a new fleet of endpoints shipping verbose telemetry, and your daily ingest can quietly double. In exchange you get a genuinely enormous app and add-on ecosystem (Splunkbase has thousands of pre-built integrations), a search language, SPL, that experienced analysts consider best-in-class for ad-hoc investigation, and vendor support that regulated industries and auditors recognize by name. None of that is free, and the pricing conversation with procurement tends to happen after the technical team has already fallen in love with the product.

Wazuh takes the opposite bet: it is free and open-source at any scale, full stop. It is built on top of OpenSearch (a fork of Elasticsearch) and combines SIEM-style centralized log analysis with host-based intrusion detection running directly on the same lightweight agent — file integrity monitoring, rootkit detection, configuration assessment, and vulnerability detection all ship in one deployment, rather than requiring a separate HIDS product bolted alongside your log pipeline. The tradeoff is ecosystem size: Wazuh's community and third-party integration catalog is smaller than Splunk's, and the company behind it is considerably smaller than either Splunk Inc. or Elastic. What you get instead is a cost curve that stays flat as your data volume grows, which matters enormously once your log volume is the thing driving the rest of the industry's pricing model.

ELK / Elastic Stack — Elasticsearch, Logstash, and Kibana, with Elastic Security layered on top — sits in between on the open-core model. The core stack is free and self-managed, and it is genuinely powerful: flexible ingest pipelines, a mature query language, and a search engine that scales to serious data volumes when tuned correctly. Elastic Security's more advanced detection features, though, live behind paid tiers, and running the whole stack well — sharding strategy, index lifecycle management, cluster sizing — requires real in-house Elasticsearch operational expertise that a lot of teams underestimate until week three of a rollout.

# Wazuh manager: checking which agents are actually reporting in
$ sudo /var/ossec/bin/agent_control -lc
Wazuh agent_control. List of agents:
   ID: 000, Name: wazuh-manager (server), IP: 127.0.0.1, Active
   ID: 003, Name: web-01, IP: 10.0.1.12, Active
   ID: 007, Name: db-02, IP: 10.0.1.30, Active
   ID: 011, Name: jump-host, IP: 10.0.1.5, Disconnected

Wazuh agent_control: Number of agents: 4

That single command doubles as a cost lesson: the same agent reporting host telemetry is also the file-integrity and rootkit sensor, at no incremental license cost — the kind of consolidation Splunk and Elastic both charge extra to approximate.

Where each one falls short

• Splunk: ingestion-based pricing can produce serious bill shock as log volume grows organically — a new application, a noisier firewall, a cloud migration that doubles telemetry — and it is easy to underestimate the real number at procurement time, before production traffic patterns are known.
• Wazuh: a smaller community and commercial support ecosystem than the other two means fewer out-of-the-box integrations for niche or legacy log sources, and you will occasionally write your own decoder or rule rather than finding one already maintained upstream.
• ELK / Elastic Security: running it well at scale requires real in-house Elasticsearch operational skill — cluster health, shard sizing, and retention tuning are not optional homework — and the free self-managed tier alone lacks some of the security-specific detection features (certain analytics, prebuilt detection rules, endpoint response actions) that live behind Elastic's paid subscriptions.

The verdict that survives budget review

Match the tool to your team's size, budget, and existing expertise — not to whichever product has the longest feature list on its homepage. A five-person security team is almost always better served by Wazuh's free, all-in-one model than by a Splunk deployment nobody funded properly, where the license renewal becomes a fight every year and the team ends up filtering out log sources just to stay under the ingest cap. Conversely, a regulated enterprise with existing Splunk expertise on staff and a genuine support requirement will find the licensing cost is the price of a tool that actually gets used properly, rather than the false economy of a free platform nobody has time to operate correctly. And if you are already running Elastic for application logs, extending into Elastic Security is frequently the path of least resistance — provided someone on the team actually understands how the cluster works underneath it. The SIEM that fits is the one your team and your budget can sustain past the first year, not the one that wins the feature comparison.