ClickHouse Observability vs Splunk

ClickHouse Observability is a turnkey, fully managed observability solution for SREs and their agents. It brings logs, metrics, traces, and session replays together, with ingestion, schemas, storage, optimization, and scaling managed for you.

Compared with Splunk, its strengths are:

• Fast SQL investigations.
• Support for high concurrency.
• Affordable retention of full-fidelity telemetry, unlocking agentic workloads.

ClickStack is the open source foundation of ClickHouse Observability. You get the familiar ClickStack investigation experience, including search, trace waterfalls, dashboards, alerts, and MCP tools, with the underlying service managed for you.

You can also run open source ClickStack yourself. For teams with database expertise, ClickHouse Observability offers a self-managed experience with control over database configuration and optimization, while ClickHouse Cloud manages the infrastructure.

ClickHouse Observability is fully managed. We handle ingestion, schemas, the database, storage, and scaling. Just send telemetry to your managed OpenTelemetry endpoint, investigate in the ClickStack UI, or connect your agents through MCP. Pricing is volume-based: on the Scale plan, list prices are $0.20 per uncompressed GB for logs, traces, and session replays and $0.10 per million metric data points. The 50% beta discount reduces these to $0.10 per GB and $0.05 per million data points. Pricing details.

Self-managed ClickHouse Observability, formerly Managed ClickStack, gives you control over database configuration and capacity. You manage your collector, schemas, compute sizing and scaling, and read/write isolation using warehouse services, tuning the deployment as your workload changes. ClickHouse Cloud still operates the underlying infrastructure. You pay for compute and storage resources under standard ClickHouse Cloud pricing, rather than telemetry ingested.

Its columnar engine reads the columns a query needs, uses indexes to skip irrelevant data, and executes queries in parallel across CPU cores and replicas. Compression reduces storage requirements and the amount of data read during investigations.

This supports fast searches and aggregations across high-cardinality telemetry, including user IDs, trace IDs, and container IDs. SREs and agents can investigate detailed events and historical patterns without relying solely on predefined summaries.

Connect your preferred agents through MCP to search logs, follow traces, analyze event patterns and deltas, and create saved searches, dashboards, and alerts. SQL enables deeper analysis, including joins, historical comparisons, and trends.

Agents can investigate unsampled telemetry with long-term context, bringing production evidence alongside code and runbooks. AI Notebooks provide an integrated investigation experience for engineers who want to work with an agent inside the product.

Yes. ClickHouse Observability supports concurrent investigations and automatically scales query compute as demand grows. Query and ingestion workloads scale independently over shared storage, so additional query capacity does not require moving stored data.

Splunk Enterprise and Splunk Cloud Platform share search capacity across scheduled and ad hoc workloads. At concurrency limits, investigations can queue and scheduled searches can be skipped, potentially leaving gaps in alert evaluation or stale results in dashboards that rely on scheduled searches.

Yes. ClickHouse Observability combines compression, object storage, and caching to keep retained telemetry queryable without requiring sampling, roll-ups, or manual restoration from an archive. SREs and agents can compare current incidents with historical behavior using the original events.

Splunk SmartStore also retrieves searchable data automatically from object storage. However, data moved into frozen archives or Dynamic Data Active Archive must be restored before searching. ClickHouse Observability keeps data within your configured retention period directly queryable.

Yes. ClickHouse Observability connects these signals so you can move from an error in a log to the associated trace, inspect service behavior, and see the user's experience through session replay. Shared identifiers and instrumentation provide the links between signals.

OpenTelemetry metrics are supported. If your monitoring depends heavily on PromQL or specialized metrics workflows, include those requirements in your evaluation rather than assuming every existing workflow transfers unchanged.

The default experience uses volume-based pricing: logs, traces, and session replays are charged per uncompressed GB ingested, and metrics per million data points. The rates are $0.20 per GB for logs, traces, and session replays and $0.10 per million metric data points, with 50% off both during public beta. See pricing for full details.

Splunk's pricing varies by product and plan, with activity-based, ingest, workload, and entity-based models.

Savings depend on your telemetry volume, retention requirements, existing contract, and the workloads you move. ClickHouse's compression and efficient query execution reduce the infrastructure required to store and analyze telemetry, while the managed service removes database administration work.

Yes. Existing OpenTelemetry collectors can forward telemetry to the managed OTLP endpoint, allowing you to retain your instrumentation and introduce ClickHouse Observability alongside your current platform. MCP-compatible agents can connect through the ClickStack MCP server.

For direct access from Grafana, BI tools, or database drivers, use the self-managed experience. That option also supports querying external databases and data lakes through ClickHouse SQL.

Start with a specific workload, such as application logs or distributed traces. Where your collection pipeline supports it, send telemetry to both platforms and validate data completeness, searches, dashboards, alerts, and performance before moving production investigations.

SPL searches, dashboards, and alerts need to be translated and tested; they do not transfer automatically. You can migrate gradually, keep historical data in Splunk initially, and expand once the new workflows meet your requirements. Parallel migration with OpenTelemetry.

ClickHouse Observability focuses on production observability and investigations for SREs and agents. It is not a direct replacement for every Splunk security, compliance, or specialist monitoring capability.