Splunk alternative for small teams
Splunk is a platform for large companies: security teams, terabytes a day and annual contracts. Estiaje gives a small team what it uses every day —searching your logs, your servers, each request's journey and alerts— for one flat price, and also watches what Splunk doesn't see: that your orders, payments and messages actually finish. Side by side.
Side by side
A small team: 2 servers, their logs and one URL checked every minute.
| Splunk | Estiaje Inicio | |
|---|---|---|
| Per month | ≈ US$120, without logs2 servers on App & Infrastructure, billed annually; logs are quoted separately | ≈ US$11billed as $199 MXN + VAT, logs included |
| How it charges | Per server, per GB of logs or per compute, on an annual contract | One flat price per plan |
| Searching your logs | SPL, a powerful query language to learn | Words, phrases and filters like bank=BBVA, no query language |
| Alert when a search spikes | Yes, with saved searches | Yes, with a 7-day preview |
| CPU, memory and disk for your servers | Yes, its strength | Yes, up to 10 servers, with “fills up on Tuesday” |
| Each request's journey across your services | Yes, with APM | Yes, included |
| OpenTelemetry intake | Yes | Yes: logs, traces and metrics |
| Grouped errors with stack traces | Inside APM | Yes, included |
| URL checks every minute | Synthetics, extra | Included |
| Status page for your customers | No | Included |
| Alerts to Slack or Discord | Yes | Yes |
| Order or payment that never finished, with the money | No | Yes |
| Security (SIEM) and self-hosting | Yes, its strength | No |
| Free plan | Splunk Free: self-hosted, 500 MB a day, no alerts or users | Errors, logs and 3 processes, nothing to install |
| Currency | US dollars | Mexican pesos, with a CFDI invoice for Mexico |
Splunk: “starting at” list prices from splunk.com/en_us/products/pricing/observability.html, October 2026, billed annually, before tax: Infrastructure US$15, App & Infrastructure US$60 and End-to-End US$75 per server a month. The example uses App & Infrastructure for 2 servers. Splunk Observability doesn't store your logs: they go to Splunk Cloud, which doesn't publish its price and is quoted by sales. Splunk Free: Splunk Enterprise's free license (help.splunk.com). Estiaje: $199 MXN plus Mexican VAT a month, about US$11 at 18.07 pesos per dollar, with 15 watched processes and up to 10 servers; your card is charged in pesos. Pro, with 75 processes and 100 servers, is $690 MXN (about US$38).
What you use Splunk for, at a flat price
- Search everything: words, phrases,
-exclude,ORand filters likeamount>500, across each event's message and attributes. And count by anything: “rejected payments by bank”. - Alerts on a search: “more than 10 in 5 minutes” or “stops arriving”, with how many times it would have fired in the last 7 days before you save it.
- Your servers: CPU, memory and disk every minute, against what's normal for that hour, and the alert before the disk fills up.
- OpenTelemetry: if you already use it, point your exporter or Collector at Estiaje without changing code.
- Alerts where your team is: on the phone, by email and in your Slack or Discord channel.
And what Splunk doesn't know about your business:
- The paid order nobody shipped. No log said error and no metric moved, but the customer is still waiting. Estiaje alerts you with how much money is at risk.
- Who needs to see it: the alert reaches whoever owns that process, even without an Estiaje account.
- Your status page, so your customers see you already know.
Which one fits you?
Stay with Splunk if…
you have a security team, need a SIEM or an audit that requires one, move terabytes of logs a day, or want it on your own servers.
Use Estiaje if…
you're a small team, your system takes payments and delivers, and you want to know when that breaks without learning SPL or signing an annual contract.
Or both
Your OpenTelemetry Collector can send to Splunk and Estiaje at the same time. You don't have to choose.
Connect it in five minutes
If you already use OpenTelemetry, it's two lines:
OTEL_EXPORTER_OTLP_ENDPOINT=https://estiaje.mx/v1/otlp
OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer ck_live_…Otherwise, with the Node SDK:
import { estiajeFromEnv } from '@estiaje/sdk';
import { medirServidor } from '@estiaje/sdk/servidor';
const estiaje = estiajeFromEnv({ service: 'shop' });
estiaje.capturarConsola(); // your logs
estiaje.capturarErrores(); // uncaught errors
medirServidor(); // CPU, memory and disk
estiaje.event('order.paid', { id, amount });
estiaje.outcome('order.shipped', { id });Python, PHP, Java, .NET, Go or Ruby? The docs have a recipe for each, and one for OpenTelemetry.
Frequently asked questions
Can Estiaje replace Splunk?
For a small team, for what gets used every day, yes: searching your logs with words and filters, alerts on a search, CPU, memory and disk for your servers, each request's journey, OpenTelemetry intake and Slack alerts, for one flat price. If you need security (a SIEM), a query language like SPL, terabytes a day or a self-hosted install, Splunk is still better there.
How much does Splunk cost?
Splunk Observability is priced per server, billed annually: from US$15 per server a month (Infrastructure), US$60 (App & Infrastructure) and US$75 (End-to-End), before tax (splunk.com, October 2026). Logs live in Splunk Cloud, which doesn't publish its price: you get a quote from sales.
Can I use Splunk and Estiaje together?
Yes. If you already use OpenTelemetry, your exporter or Collector can send to Splunk and Estiaje at the same time. The Estiaje SDK can also send the same events to any OTLP destination, with a queue for each.
Is there a free plan?
Yes. The Free plan includes grouped errors, searchable logs and 3 watched processes, no card and nothing to install. Inicio is about US$11 a month, with CPU, memory and disk for up to 10 servers, and Pro about US$38, billed in Mexican pesos ($199 and $690 MXN plus Mexican VAT). New accounts get 14 days of Pro.