Splunk's Machine Data Lake is sold as full-fidelity retention without indexing everything. A lake quote is easy to read as a replacement for indexed Splunk. It is not. The lake covers landing and retaining raw data in managed object storage. A Catalog (Splunk's discovery layer over that raw data) helps you find what is there; it does not index events for operational search. Raw search works directly against the lake on source, sourcetype, host, and time. The search you run the business on (dashboards, alerts, scheduled searches, correlation) still lives in a Splunk index. Analytics tables are for structured analysis, not continuous monitoring or Splunk event search. Depending on the workload, data moves from raw tables to analytics tables for bounded analysis, or to Splunk indexes for operational search. Getting data into either one is promotion, and it is a separate billed step. Dual-routing can keep the existing indexed ingest charge in place while a copy also lands in the lake. Promotion creates a new promoted dataset; it does not fill the index your current dashboards already use.
If you are sizing a renewal, start from the published included package (if you qualify), then get three more numbers: add-on landing above the included cap, what it costs to promote the slice you operate from (static index, streaming index, or analytics table), and what you pay when both copies exist at once. Splunk has not published a single complete per-GB rate card for that remainder. The rest of this piece lists the line items to put on the quote, and how Axiom's published meters compare.
Landing and promotion are billed separately
Landing and retaining raw data is meter one
The first meter covers getting data into the lake and keeping it there. Raw events land in managed object storage. The Catalog lists raw tables and promoted datasets so you can find sources; its metadata refreshes in the background and is not a real-time field index. Raw search lets you query that raw layer on source, sourcetype, host, and time without promoting anything first. For cold data, low-frequency compliance archives, and long-tail sources you almost never query, landing and retaining raw data may be the only lake charge you incur.
Raw search against the lake is narrower than indexed Splunk search, and it does not carry the dashboards, scheduled searches, or alerting at incident volume that most SRE and platform teams run on.
Promotion into the indexed experience is meter two
The second meter is promotion: moving data out of the lake and into a Splunk index, where it picks up richer fields, faster repeated search, dashboards, alerts, scheduled searches, and correlation. Promote to an analytics table for structured analysis, not continuous monitoring or Splunk event search. Saved searches, on-call runbooks, and correlation logic assume this indexed layer exists.
Promotion is an ongoing job, not a single switch. Static promotion covers a historical range you select up front and can write to a Splunk index or an analytics table. Streaming promotion covers matching events going forward once the job is active, writes only to a Splunk index, and does not backfill history. Streaming promotion also counts toward Ingest Processor service limits, so treat that capacity separately from raw landing. A security incident from three months ago is a static job against that window. A new source that needs alerting in real time is a streaming job that stays on. Each of those is compute and target storage on top of whatever the raw data already cost to land.
Why the promotion step exists
What the promoted target buys you
The promoted target is where operational value sits: correlation searches that join sources, alerts that fire on a threshold, dashboards refreshed on a schedule, and the field extraction that makes ad hoc investigation fast. You do not get that speed or breadth against the raw lake. The lake holds raw data for discovery and occasional inspection. Dashboards, alerts, and correlation run against a promoted Splunk index. Analytics tables cover structured analysis, not continuous monitoring or Splunk event search.
The Machine Data Lake moves the "what is searchable at production speed" decision later. You land everything first and promote once a real question shows up, instead of deciding at ingest the way classic indexed Splunk requires. You gain flexibility on when to index, and you still pay promotion compute plus storage for the promoted copy.
The raw source can outlive its promoted copy
Promotion is additive. The raw source can remain in the lake while its promoted representation lives separately, with its own retention. You can promote a 30-day window into an index for active investigation, let that copy age out, and still have the full raw history in the lake for a later static job. You keep the option to re-promote later instead of discarding the source after the indexed copy expires. It also means one logical dataset can generate charges across landing, promotion compute, and two retained copies at once, each with its own storage clock.
What Splunk has published, and what still needs a quote
The included Cisco Data Fabric package
Eligible Splunk Cloud customers on AWS commercial and Victoria Experience can use a published Cisco Data Fabric included-capacity package at no additional charge: land and retain up to 10 TB in Machine Data Lake, promote 10 GB/day to an analytics table, and run 100 federated searches/day. Anything above those caps requires purchased add-on capacity. That package is an entitlement, not a per-GB rate, and it does not publish a unit price for promoting into a Splunk index.
What a complete quote still needs to itemize
Landing above the included cap, discovery, narrow search, static index promotion, streaming index promotion (including Ingest Processor capacity), analytics-table promotion above 10 GB/day, a promoted target's storage, and retained copies are defensible line items. Splunk has not published a single public per-GB rate card that covers all of them together. There is no self-serve calculator where you enter daily volume and promotion percentage and get landing, promotion compute, promoted storage, and raw-copy cost as one number.
Before a renewal conversation, build the list yourself: whether you qualify for the included package, cost per GB to land above that cap, cost per GB or per job for static index promotion, cost per GB or per job for streaming promotion, cost per GB to store the promoted target, and cost per GB to retain the raw copy in parallel. If you dual-route, keep the existing indexed ingest line on the worksheet too. Ask for each of those separately. A single blended number hides which part of the bill is landing, which part is promotion, and which part is keeping two copies.
Indexed Cloud list pricing is a size check
You still need a reference point for the indexed side of the business. Use your current indexed Splunk Cloud quote as a size check on the operating layer you already budget. It is not a Machine Data Lake rate. Do not blend indexed Cloud pricing into a lake estimate.
What retained copies mean for the bill
A source landing in the lake at full volume, with a slice promoted for active operations, is not one storage line. It is raw storage in the lake, promoted storage in the index or analytics table, and promotion compute to move data between them, repeated whenever a streaming job stays active or a new static job runs against an older window. You set retention twice: once for the raw copy, once for the promoted copy. They do not have to match. If someone says they retain 13 months, confirm whether that is the raw copy, the promoted copy, or both, because the two retentions can differ.
That two-tier design keeps full raw history while indexing a smaller operating set. It is a different cost structure from sampling at ingest to stay inside a fixed indexing budget. Model the bill as landing, promotion (static index, streaming, analytics table), and retained copies, then ask for each rate before you compare it to classic indexed Splunk or to Axiom.
Axiom's load, query, and storage meters
Axiom's public meters are data loading, query compute, and compressed storage, with volume discounts as usage grows and a flat $25 monthly platform fee. There is no separate promotion step and no second copy to retain. Once an event loads, it is queryable through a live columnar path, then settles into compressed, field-aware blocks on object storage in the same query path. Storage cost drops automatically as data goes unqueried, across three tiers, with no restore or rehydration step before dashboards, alerts, or ad hoc queries can reach it. Axiom Cloud's $25 monthly platform fee comes with an Always Free allowance of 1 TB of data loading, 100 GB-hours of query compute, and 100 GB of storage a month, which is enough for many teams to model this against a real workload.
A side-by-side look at Axiom vs Splunk pricing models lays out the difference: Splunk's published indexed pricing runs on annual licensing measured in ingest volume or workload units sold through a sales process. Axiom's model is usage-based across those three public meters, with no overage tier and no second SKU gating which loaded data is searchable.
Coexistence first
You can keep Splunk in place and add Axiom beside it. Axiom offers a full-fidelity machine-data plane at petabyte scale designed to sit beside an existing Splunk deployment. Data can land through a Splunk HEC-compatible endpoint, the same protocol Splunk forwarders already speak, so orphaned or newly onboarded sources can go straight to Axiom without a migration project. From there, the Axiom for Splunk app and the Axiom Portal for Splunk let analysts keep querying from the Splunk search bar they already know, either through explicit ax commands or by having Axiom datasets appear as ordinary indexes. How the Axiom Portal for Splunk implements federated search pushes the expensive aggregation work down into Axiom and returns compact results to Splunk, so existing dashboards and saved searches keep working.
That path lets you run a comparison: load a genuine source into both places, promote a slice in Splunk, load the same slice into Axiom, and compare what each charged for the same workload. A ground-up reimagining of how Axiom is priced walks through why that meter structure holds as usage grows, which is the same question a lake-plus-promotion model raises. Costs stacking across separate meters is not unique to Splunk. How ingestion and searchable history get billed separately shows the same dynamic in Datadog's indexing SKU. When you compare vendors, ask which loaded data is immediately queryable for dashboards and alerts, and which data needs a second paid step first.
FAQs
It can be, for data that stays raw and rarely gets promoted. Once a meaningful share needs promotion for dashboards, alerts, or correlation, promotion compute and the promoted target's storage add a second cost on top of landing. The comparison depends on what share of the lake gets promoted.
Promotion moves data from the raw lake into a Splunk index so it can power repeated search, dashboards, alerts, scheduled searches, and correlation. An analytics table is a structured-analysis destination, not a continuous monitoring or Splunk event search path.
Static promotion covers a defined historical range selected up front and can write to a Splunk index or an analytics table, useful for an older incident. Streaming promotion covers matching events continuously after the job goes active, writes only to a Splunk index, does not backfill history, and counts toward Ingest Processor limits.
No. The raw source can remain in the lake with its own retention policy while the promoted target holds its own representation and retention schedule. A dataset can exist as two separately billed copies at once.
Yes, through raw search on source, sourcetype, host, and time. It does not carry the breadth or speed of the indexed search most operations teams rely on for dashboards and alerts. Where Splunk enables Open Sharing, selected lake data can also be read by an authorized external tool without promotion.
Splunk has published an included Cisco Data Fabric capacity package for eligible Splunk Cloud on AWS commercial and Victoria Experience (10 TB land-and-retain, 10 GB/day analytics-table promotion, 100 federated searches/day). It has not published a complete per-GB rate covering add-on landing, raw search, index promotion, streaming, the promoted target, and retained copies. That remainder requires a quote.
Axiom prices on three public meters (data loading, query compute, and compressed storage), with no separate promotion step and no second copy to retain. Loaded data stays in the same query path from recent events through settled history.
No. Axiom supports coexistence through a Splunk HEC-compatible endpoint and the Axiom for Splunk app or Portal, so new or orphaned sources can land in Axiom while existing Splunk dashboards and searches keep working.
Related Reading
Compare a real workload, line by line
Put your daily volume into the calculator on our pricing page and set it against the landing, promotion, and retained-copy line items above. Or start free, load a live source, and see what Axiom bills for the same workload. If a line-by-line walkthrough would help, our team can do that with you.