Every category where a model named Splunk for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.

Category	Function	Share	Rank	Negative rate	Labels	Quadrant	Since September 2026
Log management	IT operations and endpoint	0%	73 of 73	60%	55	criticized challenger	=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.
Observability platforms	IT operations and endpoint	0%	80 of 80	53%	17	criticized challenger	=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.
AIOps platforms	IT operations and endpoint	0%	22 of 93	20%	15	accepted challenger
Infrastructure monitoring	IT operations and endpoint	0%	79 of 79	67%	12	criticized challenger	=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.
Application performance monitoring	IT operations and endpoint	0%	59 of 66	33%	3	under 10 labels · led by New Relic at 46%	=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.
AI security platforms	Security operations	0%	201 of 233	50%	2	under 10 labels · led by SentinelOne Singularity at 11%
Identity threat detection and response	Identity and access	0%	105 of 105	100%	2	under 10 labels · led by Huntress Managed ITDR at 51%
Insider risk management	Security operations	0%	38 of 84	0%	2	under 10 labels · led by Microsoft Purview Insider Risk Management at 22%
OT and IoT security	Security operations	0%	107 of 107	100%	2	under 10 labels · led by Microsoft Defender for IoT at 21%
Data quality and observability	Data platform	0%	104 of 110	100%	1	under 10 labels · led by Metaplane at 31%
Deception technology	Security operations	0%	91 of 94	100%	1	under 10 labels · led by Thinkst Canary at 37%
GRC platforms	Security operations	0%	71 of 75	100%	1	under 10 labels · led by Hyperproof at 19%	newNew since September 2026: not ranked then, 0% now.
LLM gateways and observability	Data platform	0%	65 of 69	100%	1	under 10 labels · led by LiteLLM at 31%	newNew since September 2026: not ranked then, 0% now.
Network monitoring and management	Network and edge	0%	57 of 78	0%	1	under 10 labels · led by Auvik at 26%

Movement

Since September 2026, Splunk held within the floor in all fourteen categories: no change cleared 11 points.

Best category · Logs · by segment

Small business=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

0%from 0% in September 2026

Inside the floor by 11 pointsRank 53 of 53, unchanged

Mid-market=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

0%from 0% in September 2026

Inside the floor by 11 pointsRank 57 → 66 of 66

Enterprise▲+5Since September 2026: 41% → 45%, +5 points. Inside the 11-point floor: within noise. Read over the models both editions asked.

45%from 41% in September 2026

Inside the floor by 6 pointsRank 1 of 62, unchanged

All categories · Mid-market

Category	September 2026	Now	Change	Reading	Rank
Logs	0%	0%	=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.	Within noise	Rank 57 → 73 of 73
Observability	0%	0%	=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.	Within noise	Rank 60 → 80 of 80
AIOps	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 22 of 93, unchanged
Infra monitoring	0%	0%	=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.	Within noise	Rank 29 → 79 of 79
APM	0%	0%	=heldSince September 2026: 0% → 0%, ±0 points. Inside the 11-point floor: within noise. Read over the models both editions asked.	Within noise	Rank 50 → 59 of 66
AI security	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 201 of 233, unchanged
ITDR	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 105 of 105, unchanged
Insider risk	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 38 of 84, unchanged
OT/IoT security	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 107 of 107, unchanged
Data observability	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 104 of 110, unchanged
Deception	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 91 of 94, unchanged
GRC	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 71 of 75, unchanged
LLM gateways	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 65 of 69, unchanged
Network monitoring	0%	0%	newNew since September 2026: not ranked then, 0% now.	New this edition	Rank 57 of 78, unchanged

Shares here are read over the models both editions asked, so they can differ by a point or two from the standing above, which counts every model in this edition.

The floor is 11 points of share, measured: how far the models move a leader on their own when the same questions are asked twice with nothing changed. A larger change is movement; a smaller one is noise, and both are shown. Movement is read over the twelve models both editions asked; GPT-6 Luna, Muse Glimmer 30B joined this edition and are in the standing but not yet in the comparison. How the floor is measured · The editions

By model

How each model treated Splunk across every prompt where it was named for a mid-market B2B company. Fourteen models, six prompts per category.

ShowHide

Model	First choice	Alternative	Mention	Negative	Labels
Claude Haiku 4.5	0	0	4	4	8
GPT-5.4 mini	0	3	1	3	7
Gemini 3.5 Flash	0	1	3	7	11
Perplexity Sonar	0	0	1	2	3
Grok 4.20	0	1	9	8	18
Mistral Small	1	1	2	1	5
DeepSeek V4 Flash	0	1	1	8	10
Llama 4 Maverick	0	1	1	0	2
Qwen 3.7 Flash	0	2	5	15	22
Kimi K2	0	0	3	4	7
GLM 4.7 FlashX	0	1	1	2	4
MiniMax M2.5	1	0	3	5	9
GPT-6 Luna	0	1	1	1	3
Muse Glimmer 30B	0	1	2	3	6

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.

FramingLabels by classFirst choices

Direct53 labels11

Paraphrase49 labels10

Comparative62 labels8not counted in share

Budget-constrained51 labels5

Scale-constrained36 labels1

Negative97 labelsNone

First choiceAlternativeMentionNegative348 labels in all, every segment counted; 27 of the 35 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“For enterprises: Splunk or Datadog for advanced features and integrations.” Mistral Small · Logs · comparative prompt · first choice

“Best for: Large enterprises with complex security and compliance needs” MiniMax M2.5 · Logs · comparative prompt · first choice

“Best fit: security-heavy enterprises that need advanced search/forensics and want AIOps on top of existing Splunk data lakes.” Muse Glimmer 30B · AIOps · comparative prompt · alternative

“Choose Splunk if you are a large enterprise where compliance, advanced security analysis (SIEM)... are top priorities.” Gemini 3.5 Flash · Logs · comparative prompt · alternative

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“Splunk is notoriously expensive with pricing models that make costs difficult to control and predict ... creates vendor lock-in.” Claude Haiku 4.5 · Infra monitoring · negative prompt · hard negative

“Avoid Splunk for general application performance monitoring (APM) unless you are strictly a security organization” Qwen 3.7 Flash · Observability · negative prompt · hard negative

“Splunk/IBM setups can take months to properly deploy and fully tune, resulting in a very slow time-to-value” Gemini 3.5 Flash · AIOps · direct prompt · hard negative

“Usually not the best for a limited budget: Splunk and often Datadog, because costs tend to rise quickly” GPT-5.4 mini · Logs · budget prompt · hard negative

Named alongside

The products named in the same answers as Splunk, over the 348 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and Splunk was named but was not.

ShowHide

ProductSame answerTook the first choice insteadHead to head

Datadog Log Management149 of 34821Not among the top eight

Dynatrace138 of 34829Not among the top eight

Elastic Stack131 of 3485Not among the top eight

Datadog118 of 34828Not among the top eight

New Relic104 of 34813Not among the top eight

Grafana Loki93 of 34812Not among the top eight

Graylog75 of 34810Not among the top eight

Sumo Logic59 of 3481Not among the top eight

New Relic Logs54 of 3483Not among the top eight

Grafana44 of 34811Not among the top eight

A head-to-head page exists where both products are among a category's top eight. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named Splunk. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, five of the fourteen in this edition, so these counts come from 287 of the 348 answers that named Splunk and are not a share of its labels.

Domains cited

openobserve.ai113

middleware.io102

motadata.com101

cribl.io81

signoz.io73

guideflow.com69

coralogix.com63

g2.com63

newrelic.com63

learn.g2.com61

789 of the 789 domain citations in answers naming Splunk came from somebody else's page.

Pages cited

cribl.io/resources/comparison-guides/top-10-log-collection-and-analysis-platforms64

openobserve.ai/blog/log-management-tools60

middleware.io/blog/log-management-tools59

dupple.com/learn/best-log-management-tools43

learn.g2.com/best-log-monitoring-software41

guideflow.com/blog/log-analysis-software40

process.st/log-management-tools37

signoz.io/blog/best-log-management-tools36

Pages are listed as the models cited them.

Search and answers

splunk.com is not in Google's top ten for any of the category's searches. In the answers, Splunk takes 0% of first choices and Datadog Log Management takes 28%.

ShowHide

In search

Google, US estimates

Position for “log management platform”

–

not in the top ten

Position for “log management platforms”

–

not in the top ten

Searches for its name, Google: 40,500 a month (“splunk”)
AI search demand for its name, est.: 6,832 a month
Organic visits to its site: about 892,906 a month
Searches its site ranks for: 58,364 · 6,154 in the top three
Sites linking to it: 32,642
Paid Google search: No ads found in the estimate; that does not mean it runs none

Ads on GoogleDetailLess

120+ ads · 102 text, 16 image, 2 video · 120 shown in the last 30 days

First shown October 2021, as Cisco Systems, Inc., verified. Ads started 2025-10 to 2026-09: 72 in the year, 48 before.

On Google's pages: 1 2 3 4

In answers

This edition

Share of first choices

rank 73 of 73 in logs

Segment leader

28%

Datadog Log Management

First choices: 27 across its categories
Named in: 348 answers
Its own site cited: in 287 of the answers that named it

Search figures are US estimates from DataForSEO, read September 28, 2026; AI search demand is its modeled, directional estimate, not a count of queries to any assistant. The answers are this edition's. Two measurements side by side: neither is read as the cause of the other.

What it publishes

ShowHide

Addresses on splunk.com

10,725

subdomains included

Content

4,642

counted in the table below

Documentation

Product · Integration

152 · 20

Kind	Pages	Last 90 days	Latest
Blog	2,939	8	2026-09-17
Glossary or explainer	718	9	2026-09-23
Podcast or video	357	5	2026-09-24
Case study	241	0	2021-01-01
News or press	199	0	2025-11-20
Comparison	81	2	2026-09-11
Conference or event	58	0	2026-06-15
Report or ebook	28	0	2024-12-10
Webinar or virtual event	13	0	2024-06-03
Template or tool	8	0	2025-09-08

Most recent

2026-09-24Seamless security realized how splunk and aws enable machine speed threat mitigation through unified telemetry podcast or video
2026-09-23Openai swarm framework glossary or explainer
2026-09-23Splunk aws building the agentic enterprise together podcast or video
2026-09-23From alert fatigue to action native security hub findings in splunk podcast or video
2026-09-22Agent frameworks glossary or explainer
2026-09-22Agent performance metrics glossary or explainer

Events in person

Last twelve months

April 8, 2026GovSummit 2026Washington D.C. · took part
March 31, 2026 to April 2, 2026Forum INCYBER Europe 2026Lille, France · attended

As the event pages on splunk.com state them, read September 28, 2026.

How it is countedHide how it is counted

Every page splunk.com exposes, subdomains included. Kind is read from the address and title. The last 90 days, the latest date and the twelve months count pages by when they were published, from the site's feeds, a date in the address, or the page's own publication date, read from up to a hundred of its most recently changed pages; a page that says only when it last changed is counted in its kind but not in when, so the recent counts are a floor, and a kind none of whose pages gives a publication date reads undated. An event counts as online when its address or title says so (webinar, on demand, virtual or online summit); a conference, summit, trade show, expo or roadshow that does not say so is counted as a conference or event, which on a vendor's site is mostly in person. Read September 29, 2026.

Names read as Splunk

What the judge wrote, as written, with how often. The vendor table decides that these count as Splunk; a claim can dispute any of them.

Splunk (Cisco) / AppDynamics 1Splunk (IT Service Intelligence) 1Splunk (Splunk Observability Cloud) 1Splunk (now Cisco) 1Splunk / Cisco Splunk 1Splunk Cloud 1Splunk Enterprise 1

Follow Splunk

An email the morning each edition publishes: where this product moved, where it held, and by how much against the noise floor. One address, confirmed by a click; a stop link in every email.

Already following? Everything you follow, with a stop for each.

The company

Splunk is its own company.

ShowHide

In its own words

Stated by the vendor, not checked

Positioning: Data Platform for Security, Observability & AI
splunk.com
For: SecOps、ITOps 和 NetOps 团队
splunk.com/zh_cn/products/aipod.html
Price stated: All pricing is in U.S. Dollars. For a formal quote, please contact your account team. Pricing and availability are subject to change. splunk.com/en_us/training/pricing.html
Free plan or trial: This course is also available as video-only eLearning for free. splunk.com/en_us/training/pricing.html
Integrations claimed: 2000 splunk.com
Customers named: Progressive InsuranceSingapore AirlinesCarrefourSpecsaversLINEヤフー株式会社
Not stated on the pages read: Starting price, certifications, hosting

What Splunk's own pages state, read September 28, 2026: splunk.com, splunk.com/en_us/training/pricing.html, splunk.com/ja_jp/blog/security/ctf-botsv8.html, splunk.com/zh_cn/products/aipod.html. A claimed page can correct any of them.

Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Splunk's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Splunk, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

What a new claim receivesHide what a new claim receives

A new claim receives the current edition's vendor brief for Splunk by email, built from the raw record of the edition. It shows:

where Splunk is named, by buyer and by framing, and which cells hold its first choices;
the claims the models make when they name it, ranked, with the strongest and the weakest quoted;
its vocabulary against the segment leader's, and the pages the models cited;
who was chosen in the answers that did not name Splunk, and every reason the record gives;
a battlecard for each top rival: the head-to-head split, why they win, and the reservation quoted against them;
one page of published figures cleared to show a buyer.