Sasquatch
Splunk
Sasquatch vs Splunk
One product vs four.
10 TB / month of K8s logs (~333 GB/day) · annual list. Two invoices, two architectures, one obvious choice.
Sasquatch
Lossless edge compression · BYO cloud
$12,144
per year · list
Compression18×
Storageyour S3
Query langsSPL adapter included
vs
−98%
you keep
$738k / yr
−98%
Splunk
Enterprise SIEM + observability
$750,000
per year · list
Ingest modelWorkload + Ingest
Annual hike+9% per renewal
Query langSPL
18×
Compression
~98%
Less bill
+9%/yr
Splunk renewal
0
SPL training cost
The annual bill
Stack the meters.
Sasquatch
Bytes in · edge compress · your bucket
Splunk
Splunk list — published rates only
$12,144
Sasquatch per-byte
$750,000
Ingest license (333 GB/d)
Search head + indexer
$12,144−98%$750,000
The product surface
One SKU. Four pricing models.
Sasquatch
One product. One rate.
Splunk
Pick your model — and renegotiate next renewal.
1
Bytes-in
Logs · Traces · Metrics
Workload Pricing (SVCs)
Ingest Pricing (GB/day)
Entity Pricing (hosts)
Activity Pricing (MTS/traces/sessions)
4separate meters
Where the bytes go
Compress at the edge — or after the bill?
Sasquatch
Pods → 18× compress → your bucket → SPL adapter
Splunk
Forwarder → Splunk Cloud index → SPL only
Your K8s pods
OTLP gRPC / HTTP
Edge compress 18×
10 TB → 555 GB
Your S3 / GCS / Azure
your KMS key
LogQL · SPL · PromQL
TraceQL — pick yours
Your K8s pods
HEC / forwarder agent
Splunk Cloud ingest
~$2,250/GB/day/yr list
Splunk indexer
proprietary tsidx
SPL
one query language
The compression
10 TB in. 555 GB out.
Sasquatch
Schema-aware Zstd · per-event · SHA-256 verified
Splunk
tsidx + LZ-family compression — proprietary, not portable.
18×95%
ratiosaved
10 TB → 555 GB
Lossless · SHA-256(decompress(compress(x))) == SHA-256(x)
~3×67%
ratiosaved
10 TB → ~3.3 TB
Format compression — bytes still billed pre-compression.
The meters
One rate. Four contradictory models.
Sasquatch
Bytes in at the edge — one rate
Splunk
5 separately metered axes
Bytes in at the edge
Logs · Traces · Metrics — one rate
0YOUR BYTES∞
Workload (SVCs)
compute-basedIngest (GB/day)
~$1,800-2,700/GB/dayEntity (hosts)
per protected hostActivity (MTS)
per metric time seriesAnnual renewal hike
+9% listCapability matrix
Where each tool wins.
Last three rows: places the competitor out-ships us today.
Lossless guarantee | ||
BYO cloud storage + KMS | ||
Compression ratio (K8s) | 18× | ~3× |
Bytes-in pricing | ||
No host meter | ||
No event indexing tax | ||
High-cardinality metrics free | ||
Egress on compressed bytes | ||
Multi-language query | ||
Portable archive format | ||
Air-gap deploy | ||
Hot-path forwarder | n/a | |
AIOps / Watchdog-class | ||
700+ pre-built integrations | ||
Built-in CSPM / Cloud SIEM |
Show us your Splunk renewal letter.
We back-compute the equivalent Sasquatch + your-bucket spend — and ship an SPL adapter so your team keeps SPL muscle memory.