Replace / Splunk
Replace Splunk with OpenSearch
The best open-source alternative to Splunk is OpenSearch, self-hosted on Railway. Search and logs you host. OpenSearch is Apache-2.0. Elasticsearch is Elastic License / SSPL — not the OSI path.
Estimated save $2,400 a year.
Open the stackStart on Railway
How Splunk compares
| Splunk | OpenSearch | |
|---|---|---|
| Pricing model | Hosted subscription | Open-source or fair-code license; you pay the host |
| Hosting | Vendor cloud | Self-hosted on Railway or any VPS |
| Rough monthly cost | Public list price not verified this run | Hosting only — no SaaS seat meter in this repo |
- OpenSearch
Apache-2.0 search and analytics suite
FAQ
- Is it free?
- The OpenSearch licenses are open source or fair-code. You still pay hosting (Railway or any VPS) and any APIs the stack calls. There is no Splunk seat or task bill on this path.
- Can I migrate from Splunk?
- Yes. Start with the workflows or data you actually use, then cut over. The OpenSearch stack page has the agent prompt and the cost table; most teams rebuild the slice that matters and leave old Splunk links until they expire.
- How do I deploy it?
- Open the OpenSearch stack, copy the agent prompt, and deploy on Railway (one service, PORT, and a volume when the app needs disk). Placeholder: OpenSearch plus a volume (heap-hungry JVM — size the box). Dashboards is a second service. No one-click template in this repo yet — Start on Railway. Site search can sit on /stacks/meilisearch-search; APM on /stacks/signoz-observability.
- What does this replace?
- Elastic Cloud / Splunk / Papertrail. The published small-team estimate on this stack is $2,400 a year.
Related pages
Stack of the Week
Get one stack a week that replaces a SaaS bill.