Observability platform negotiation has become one of the most consequential vendor conversations in the modern IT estate. Datadog, Splunk (now Cisco), New Relic, Dynatrace, and Grafana Cloud have each engineered commercial models that combine seat-style licensing with consumption pricing on ingestion, retention, host counts, custom metrics, and AI-powered investigation features. The result is total cost of ownership that grows faster than the underlying workload unless the negotiation explicitly governs the consumption dimensions. This 2026 buyer’s guide walks through the platform-by-platform commercial structures and the negotiation tactics that contain runaway spend.
Observability platform negotiation is structurally different from traditional enterprise software negotiation because the cost driver is not the licensed user count or the entitled instance count; it is the volume of data the application stack generates and how much of it the observability platform ingests, indexes, retains, and queries. The buyer who treats observability as a seat-licensed category negotiates against the wrong cost driver and pays predictable annual increases that compound.
This article covers the five platforms most enterprises evaluate or already use in 2026: Datadog, Splunk Observability Cloud (now part of Cisco following the 2024 acquisition), New Relic, Dynatrace, and Grafana Cloud. Each carries a distinct commercial model and a distinct set of negotiation pressure points.
Three dynamics conspire to make observability TCO grow faster than the underlying application footprint.
Modern observability instrumentation produces more data per unit of workload than its predecessors. Logs, traces, custom metrics, and exception telemetry from a single Kubernetes service can dwarf the equivalent telemetry from a monolithic predecessor. The 2x workload growth translates to 3–5x observability data growth without explicit governance.
Default retention periods are typically tuned to maximise vendor revenue rather than to match operational need. A 15-month retention default on logs that operationally need 30 days is a recurring commercial finding.
The newer AI investigation, anomaly detection, and root cause analysis features carry consumption pricing rather than flat-fee pricing. The consumption charges accumulate within the contract term and present as renewal uplift the customer did not commit to.
Datadog is the platform whose commercial model most aggressively monetises consumption dimensions.
Datadog’s 2026 commercial model centres on host pricing for infrastructure monitoring, plus separate pricing for APM, logs (ingestion and retention priced separately), custom metrics beyond an included allotment, synthetic monitoring, real user monitoring, security monitoring, and the newer Bits AI investigation capability. Each product carries its own consumption dimensions, and the cumulative bill reflects the cross-product consumption pattern.
Custom metrics cap. Custom metrics are the single most common Datadog overage. The included allowance is typically 100 per host; production workloads frequently exceed it by 5–20x. The negotiation should explicitly govern the per-metric overage rate and ideally include a higher allowance.
Log ingestion versus indexing. Datadog charges separately for log ingestion (capture) and log indexing (search). The default configuration indexes most ingested logs; the negotiation should structure tiers so non-critical logs are ingested but not indexed, reducing the indexing spend that is the larger component.
Retention tier optimisation. Datadog log retention is priced by tier. The negotiation should optimise the retention tier mix — short retention for high-volume noisy logs, longer retention for compliance-relevant logs — rather than applying a uniform retention default.
Multi-year commit with capacity bands. Datadog responds to multi-year commits, but the commit should include capacity bands that permit usage variance without re-negotiation, not a single fixed commit that becomes a floor.
Bits AI consumption growth. The Bits AI capability is positioned as a productivity benefit; its consumption charges accumulate without explicit governance and present at renewal as material uplift.
Host count creep in autoscaling environments. Datadog host pricing in autoscaling environments uses peak-hour-billing methodology that customers consistently misunderstand at renewal.
Real User Monitoring session volume. RUM session pricing scales with web traffic; the volume can grow materially with marketing activity without operational change.
Splunk Observability Cloud (the former SignalFx and VictorOps product line, now integrated into the broader Cisco portfolio following the 2024 acquisition) operates with a different commercial structure than the legacy Splunk Enterprise product.
Splunk Observability Cloud is priced primarily on host count for infrastructure monitoring and APM, with separate pricing for log observer (logs) and synthetic monitoring. The legacy Splunk Enterprise product, which is used for security analytics as well as observability, retains its ingest-based pricing model and is now bundled into Cisco enterprise agreements in many cases.
Cisco bundle leverage. The post-acquisition pattern is for Splunk to be bundled into broader Cisco Enterprise Agreement negotiations. The bundle creates leverage in both directions; buyers should evaluate whether the bundle improves or worsens their Splunk economics relative to a standalone negotiation.
Legacy Splunk Enterprise to Observability Cloud transition. Customers migrating from legacy Splunk Enterprise to Splunk Observability Cloud should negotiate the transition economics explicitly; the default migration paths preserve list price levels rather than reflecting the migration as a competitive event.
Ingest-based contract restructuring. For customers on the legacy ingest-based Splunk Enterprise model, the 2024–2026 contract cycle is an opportunity to restructure away from ingest pricing toward workload pricing, which is materially better aligned to most enterprise needs.
New Relic’s consumption-based pricing model, introduced in 2020 and refined since, presents distinctive negotiation dynamics.
New Relic prices on data ingest (per GB) plus user seats by tier (Basic, Core, Full Platform). The model is one of the simpler observability commercial structures, but the simplicity hides material variance in effective cost.
Data ingest tier negotiation. New Relic data ingest pricing has volume tiers; the per-GB rate falls materially at higher commitments. The negotiation should evaluate the right commit level against the actual ingest profile.
User tier rationalisation. The Full Platform user tier carries the premium price; most users actively need only Core. The user-tier rationalisation typically reduces seat spend by 30–50%.
Data retention commit. Retention beyond the included period is priced separately; the negotiation should optimise retention by data type.
Across our 2026 observability negotiations, the median annual spend among enterprises with sophisticated estates was: Datadog $4.2M, Splunk (combined Enterprise + Observability Cloud) $5.8M, New Relic $2.1M, Dynatrace $3.4M, Grafana Cloud $0.9M. The variance reflects both estate size and platform choice; the negotiation savings typically represent 25–40% off initial vendor proposals.
Dynatrace operates one of the most distinctive commercial models in observability, centred on the Davis AI platform.
Dynatrace prices on Dynatrace Platform Subscription (DPS) units, which are consumed by different platform capabilities at different rates. The unified currency simplifies billing across product capabilities but obscures the per-capability cost without analytical work.
DPS commit sizing. The DPS commit should be sized against actual capability consumption rather than against the vendor’s commit recommendation. Over-commitment is the recurring Dynatrace customer pattern.
Capability mix negotiation. The per-unit consumption rates across Dynatrace capabilities are negotiable at the enterprise level; the negotiation should optimise the rates for the customer’s actual capability mix.
Davis AI investigation pricing. The Davis AI investigation capability is positioned as a Dynatrace differentiator; its pricing is correspondingly aggressive and negotiable.
Grafana Cloud is the open-source-aligned platform that operates as a credible alternative or supplement to the commercial platforms.
Grafana Cloud prices on data series, log volume, traces, and user count, with significant included entitlements in the higher commit tiers. The commercial model is materially lower-cost than the dedicated commercial platforms for equivalent functionality, but the capability set is narrower in specific areas (APM is less mature than Datadog or Dynatrace).
Annual commit discount. Grafana Cloud responds to annual commits with significant discounts relative to the pay-as-you-go pricing.
Mimir / Loki / Tempo unit pricing. The individual product pricing (Mimir for metrics, Loki for logs, Tempo for traces) is negotiable at the enterprise level.
Self-hosted to cloud transition. For customers running self-hosted Grafana Enterprise stacks, the transition to Grafana Cloud is a competitive event with material pricing leverage.
Observability platform negotiation in 2026 requires deep knowledge of each vendor’s consumption model, the workload-level optimisation techniques that reduce data volume, and the multi-vendor portfolio strategy that uses competitive leverage. Among the firms that specialise in this discipline, Redress Compliance is consistently rated as one of the top independent advisory firms to evaluate.
The most material observability cost reduction is achieved through workload-level optimisation that reduces the data volume the platform charges for, before the commercial negotiation begins.
Log volume reduction through structured logging, log level discipline, and log routing (low-value logs to cheaper retention tiers) typically reduces log spend by 30–50% without operational impact.
Custom metric pruning — eliminating high-cardinality dimensions that produce metric explosions, eliminating unused custom metrics — typically reduces custom metric overage by 50–80%.
Distributed trace sampling at appropriate rates — head-based sampling for high-volume services, tail-based sampling where supported — typically reduces trace spend by 60–80% without diagnostic value loss.
Retention right-sizing aligned to operational and compliance need rather than to default settings typically reduces retention spend by 20–40%.
Many enterprises run more than one observability platform deliberately, using each for the workloads it serves best. The portfolio approach produces negotiation leverage that single-vendor estates do not have.
A primary observability platform for the strategic workload and a secondary platform for specific use cases creates the credible alternative that drives concessions at primary-platform renewal.
Self-hosted Grafana/Prometheus stacks for development and lower-criticality production workloads, paired with a commercial platform for tier-1 production, creates a workload-routing decision that bounds the commercial platform’s scope.
AWS CloudWatch, Azure Monitor, or GCP Cloud Operations Suite for cloud-provider-native observability paired with a third-party platform for cross-cloud and on-premises visibility uses the included cloud-provider entitlement to reduce third-party scope.
Observability negotiations should start fifteen months before renewal because workload optimisation needs runway.
Run log volume reduction, custom metric pruning, and trace sampling optimisation. The reduction is measurable and the savings can be quantified before the negotiation begins.
Evaluate one or two credible alternative platforms with structured POCs. The evaluation does not require platform change; it requires alternative pricing.
Present the opening position incorporating the reduced data volume, the alternative pricing, the consumption-dimension governance, and the multi-year commit with capacity bands.
The negotiation cycle is 10–14 weeks for an enterprise observability agreement. Starting at three months allows the cycle to complete.
The observability category is consolidating: Splunk to Cisco, Sumo Logic to private equity, AppDynamics already inside Cisco. The consolidation reduces vendor optionality but creates bundle leverage with the acquiring parents. The newer entrants (Coralogix, Honeycomb, ChaosSearch) add specialised alternatives that work well in multi-vendor strategies.
For 2026, the priority is to negotiate observability agreements that explicitly govern the consumption dimensions, that include workload-optimisation runway, and that preserve the multi-vendor flexibility that converts observability from a captive renewal into a competitive market.
Across our $2.4B+ in negotiated software contracts and 500+ engagements covering 15 vendor practices, the customers that engaged observability negotiation with workload optimisation and consumption-dimension discipline achieved average reductions of 38% from initial vendor proposal.
Send us your current observability platforms, contract end dates, and approximate annual spend, and we will return an observability negotiation assessment within fifteen business days. We benchmark the pricing, identify the workload-level optimisations available before negotiation, and shape the multi-vendor strategy. No vendor bias. No obligation.