Datadog vs Splunk in 2026 - Complete Comparison Guide

Introduction

Datadog and Splunk are two of the most prominent names in observability and log management. Engineering teams evaluating their monitoring stack inevitably encounter both platforms, and for good reason: each has carved out a significant market position with distinct strengths and loyal user bases.

But they approach the problem from fundamentally different angles. Datadog was born in the cloud era, built as a SaaS-first monitoring platform optimized for cloud-native infrastructure. Splunk, on the other hand, pioneered machine data analytics over two decades ago and has evolved into an enterprise powerhouse, now under Cisco's umbrella after a landmark $28 billion acquisition in 2024.

Choosing between them is not straightforward. The right answer depends on your infrastructure, team skills, compliance requirements, and critically, your budget. Both platforms are feature-rich, but both come with price tags that can shock even well-funded engineering organizations.

This guide provides a detailed, head-to-head comparison across every dimension that matters: APM, log management, infrastructure monitoring, pricing, scalability, ease of use, security, and vendor lock-in. We will also explore Parseable as a cost-effective, open-source alternative that delivers unified observability at a fraction of the cost.

Datadog vs Splunk: Overview

What is Datadog?

Datadog is a cloud-native SaaS monitoring and analytics platform founded in 2010. After its IPO in 2019, Datadog grew rapidly to become one of the most valuable publicly traded infrastructure software companies, with a market capitalization hovering around $40 billion.

Datadog's core value proposition is bringing infrastructure monitoring, APM, log management, synthetic monitoring, real user monitoring (RUM), and security under one roof, all delivered as a fully managed SaaS platform. With over 750 integrations spanning cloud providers, databases, orchestration tools, and application frameworks, Datadog can instrument nearly any modern stack within hours.

The platform follows a per-host plus per-GB pricing model, where you pay separately for infrastructure agents, log ingestion, APM hosts, custom metrics, and various add-ons. This modular pricing gives teams flexibility to adopt only what they need, but it also means the total bill can escalate quickly as usage grows across multiple product lines.

Datadog excels in environments built on AWS, GCP, or Azure, with deep integrations for Kubernetes, serverless functions, and container orchestration. Its auto-discovery capabilities and out-of-the-box dashboards make it particularly attractive for DevOps teams that want fast time-to-value.

What is Splunk?

Splunk is an enterprise data analytics and SIEM (Security Information and Event Management) platform founded in 2003. It was one of the first platforms to make machine data searchable and actionable, and it has remained a dominant force in the enterprise observability and security markets for over two decades.

In March 2024, Cisco completed its acquisition of Splunk for $28 billion, making it the largest acquisition in Cisco's history. This acquisition positions Splunk as the observability and security backbone within Cisco's broader networking and infrastructure portfolio.

Splunk's greatest strength lies in its Search Processing Language (SPL), a powerful and flexible query language that allows analysts to perform complex transformations, statistical analyses, and correlations across massive datasets. SPL is effectively a domain-specific language for machine data, and experienced Splunk users can accomplish tasks that would require multiple tools on other platforms.

The platform follows volume-based licensing, typically priced per GB of data ingested per day. Enterprise pricing starts at roughly $150 per GB/day/year for on-premises deployments, with Splunk Cloud carrying a premium for managed infrastructure. Additional costs include premium apps like Splunk Enterprise Security (ES) and Splunk SOAR (Security Orchestration, Automation, and Response).

Splunk's architecture relies on a multi-component deployment model: forwarders collect data, indexers store and index it, and search heads process queries. While powerful, this architecture requires dedicated infrastructure teams to manage at scale.

Head-to-Head Comparison

APM and Application Monitoring: Datadog Wins

Application Performance Monitoring is where Datadog pulls ahead most decisively. Datadog's APM was purpose-built as a core part of the platform and includes distributed tracing, continuous profiling, error tracking, database query monitoring, and service maps that visualize dependencies in real time.

Datadog's distributed tracing implementation is particularly mature. It supports automatic instrumentation for over 15 programming languages, with trace-to-log correlation that lets you jump from a slow trace directly to the relevant log lines. The platform's Service Catalog provides a centralized inventory of all services with ownership metadata, SLOs, and dependency maps, making it a powerful tool for both debugging and capacity planning.

Splunk's APM capabilities came primarily through its 2019 acquisition of SignalFx. While the integration has progressed steadily, Splunk APM still feels like an acquired product rather than a native feature. The tracing capabilities are solid, and Splunk does support full-fidelity trace ingestion (no sampling), which is a notable advantage for teams that need every trace for compliance or debugging. However, the setup process is more involved, and the correlation between Splunk APM and Splunk's core log platform is not as seamless as Datadog's unified experience.

Both platforms support OpenTelemetry for instrumentation, but Datadog's auto-instrumentation libraries are generally smoother to deploy and produce richer metadata out of the box. Splunk has invested heavily in OpenTelemetry compatibility (Splunk contributes actively to the OTel project), but the practical experience of getting from zero to full APM visibility is faster with Datadog.

Verdict: Datadog's APM is more comprehensive, easier to set up, and more tightly integrated with the rest of the platform. If APM is your primary use case, Datadog is the stronger choice.

Log Management: Splunk for Enterprise, Datadog for Cloud-Native

Log management is where Splunk has historically dominated, and it remains the platform's greatest strength. SPL gives analysts unmatched power to parse, transform, correlate, and visualize log data. Complex multi-step investigations that require joining data from different sources, computing statistical aggregations, and building ad-hoc reports are where SPL truly excels. For security analysts and IT operations teams that live in logs all day, SPL's expressiveness is a genuine competitive advantage.

Splunk also handles heterogeneous log formats exceptionally well. Its field extraction capabilities, both automatic and rule-based, can parse virtually any log format, including proprietary formats from legacy systems, mainframes, and network devices. For enterprises with decades of infrastructure and diverse log sources, this flexibility is invaluable.

Datadog's log management is strong and has improved significantly in recent years, but it takes a different approach. Rather than offering a powerful query language, Datadog focuses on intuitive workflows: log pipelines for parsing and enrichment, faceted search for exploration, and tight integration with traces and metrics for contextual investigation. For cloud-native teams running microservices on Kubernetes, Datadog's log management feels natural and efficient.

However, Datadog's log management has limitations when it comes to complex analytics. Its query language is simpler than SPL, which means some advanced transformations require workarounds or are simply not possible. Additionally, Datadog's log pricing is structured around ingestion, indexing, and retention separately, which can make cost management complex when you need both real-time access and long-term retention.

Splunk's log management also benefits from its deep integration with Splunk Enterprise Security. For organizations where log management serves both operational and security use cases, Splunk provides a unified platform that eliminates the need to ship logs to multiple destinations.

Verdict: Splunk for complex enterprise log analytics and security use cases. Datadog for cloud-native teams that want integrated, intuitive log management alongside APM and infrastructure monitoring.

Infrastructure Monitoring: Depends on Your Stack

Both platforms offer comprehensive infrastructure monitoring, but their strengths align with different environments.

Datadog excels at cloud infrastructure monitoring. Its integrations with AWS, GCP, and Azure are deep and well-maintained, providing automatic discovery of cloud resources, pre-built dashboards for every managed service, and real-time metrics collection with minimal configuration. Datadog's container and Kubernetes monitoring is particularly strong, with live container maps, pod-level metrics, and automatic tagging that propagates through all telemetry types.

Splunk's infrastructure monitoring, powered by the former SignalFx technology, provides solid cloud monitoring capabilities. But where Splunk truly differentiates is in hybrid and on-premises environments. Splunk IT Service Intelligence (ITSI) provides service-level monitoring that maps business services to underlying infrastructure components, enabling both IT operations and business stakeholders to understand the impact of infrastructure issues on business outcomes.

For organizations running a mix of cloud and on-premises infrastructure including legacy systems, network devices, and traditional data centers, Splunk's broader data collection capabilities and ITSI's service modeling provide a more complete picture.

Verdict: Datadog for cloud-native and Kubernetes-heavy infrastructure. Splunk for hybrid and on-premises environments where business service modeling is a priority.

Pricing: Neither is Affordable at Scale

This is the section that matters most for budget-conscious engineering leaders. Both Datadog and Splunk are premium platforms, and both have earned reputations for pricing that can escalate rapidly as data volumes grow.

Datadog Pricing Breakdown

Datadog uses a modular pricing model where each product line has its own pricing structure:

Estimated annual cost at 100GB/day log volume with 50 hosts:

• Log Ingestion: 100GB x 30 days x $0.10 = $300/month
• Log Indexing (assuming ~500M events/month): ~$850/month
• Infrastructure (50 hosts, Enterprise): $1,150/month
• APM (50 hosts, Enterprise): $2,000/month
• Custom Metrics (2,000 metrics): $100/month
• Monthly total: ~$4,400 | Annual total: ~$52,800

But this is a conservative scenario. At enterprise scale with 200+ hosts, custom metrics proliferation, and longer retention needs, annual costs of $195,000 or more are common. The real bill shock comes from custom metrics: teams frequently discover that Kubernetes labels, application tags, and auto-instrumentation generate thousands of custom metrics they did not explicitly create, each billed at $0.05/metric/month.

Splunk Pricing Breakdown

Splunk uses volume-based licensing, priced per GB of data ingested per day:

Estimated annual cost at 100GB/day:

• Splunk Cloud (100GB/day at $200/GB): $200,000/year
• Add Splunk ES for security: additional $50,000-75,000/year
• Total with ES: $250,000-275,000/year

Splunk's pricing model is simpler to understand but no less expensive. Volume discounts exist for large commitments, but they typically require multi-year contracts. The cost per GB makes it financially painful to retain data for extended periods, which is ironic for a platform whose primary value proposition is deep historical analytics.

The Bill Shock Problem

Both platforms are notorious for surprise cost escalations:

• Datadog: Custom metrics, indexed spans, and log volume overages are the most common sources of unexpected charges. Teams frequently report bills that are 2-3x their initial estimates after 6 months of production usage.
• Splunk: Data volume growth is the primary cost driver. As applications scale and new log sources are added, the daily ingestion volume can grow 20-50% year over year, directly increasing licensing costs.

Cost Comparison at Scale

These numbers assume a mix of log management, infrastructure monitoring, and APM. Actual costs vary based on host count, retention requirements, and specific feature usage.

Scalability: Both Handle Enterprise Scale

Both Datadog and Splunk can handle enterprise-scale workloads, but they achieve this through fundamentally different architectures.

Datadog is a fully managed SaaS platform. Scaling is handled entirely by Datadog's infrastructure team, which means you do not need to worry about capacity planning, cluster management, or infrastructure upgrades. For teams that want to focus on using observability data rather than managing observability infrastructure, this is a significant advantage. Datadog regularly processes petabytes of data daily across its customer base.

Splunk scales through a distributed architecture of indexers, search heads, and forwarders. Splunk Enterprise can be deployed as a cluster with dozens or hundreds of indexers, each handling a portion of the data. This architecture is battle-tested at petabyte scale, but it requires dedicated Splunk administrators to manage. Splunk Cloud abstracts some of this complexity, but even Cloud deployments require capacity planning and occasional coordination with Splunk's support team for scaling events.

Verdict: Both platforms handle enterprise scale. Datadog eliminates scaling as an operational concern. Splunk offers more control but requires more operational investment.

Ease of Use and Learning Curve: Datadog Wins

Datadog's ease of use is one of its strongest selling points. The platform is designed for rapid onboarding: install an agent, enable integrations, and within minutes you have metrics, dashboards, and alerts flowing. The UI is intuitive, with auto-discovery that automatically detects services, containers, and cloud resources. Pre-built dashboards and monitors provide immediate value before any customization.

Splunk's learning curve is significantly steeper. SPL is powerful, but it is a domain-specific language that takes weeks or months to learn well. Building effective searches, creating optimized reports, and managing knowledge objects (field extractions, lookups, saved searches) all require training. Splunk offers extensive documentation and a certification program, but the investment required to become proficient is substantial.

The administrative burden is also higher with Splunk. Managing indexer clusters, search head pools, forwarder deployments, and data inputs requires dedicated Splunk administrators. Datadog, as a SaaS platform, eliminates this operational overhead entirely.

For teams evaluating time-to-value, Datadog typically delivers meaningful monitoring within hours, while Splunk deployments can take days or weeks to reach equivalent coverage, particularly in complex environments.

Verdict: Datadog wins on ease of use, onboarding speed, and time-to-value. Splunk's complexity pays off for advanced use cases, but the learning investment is real.

Security and Compliance: Splunk Leads

Splunk Enterprise Security (ES) is one of the most mature and widely deployed SIEM platforms in the market. It provides pre-built correlation rules, risk-based alerting, threat intelligence integration, and compliance frameworks that security teams rely on daily. Major financial institutions, government agencies, and healthcare organizations use Splunk ES as their primary SIEM.

Splunk also offers SOAR (Security Orchestration, Automation, and Response) for automated incident response playbooks, and its acquisition by Cisco further strengthens its security positioning with integration into Cisco's broader security portfolio including Talos threat intelligence, XDR, and network security products.

Datadog Cloud SIEM is a growing product that provides threat detection, investigation, and compliance monitoring. It benefits from tight integration with Datadog's infrastructure and APM data, which provides richer context for security investigations. However, Datadog Cloud SIEM is less mature than Splunk ES, with fewer pre-built detection rules, fewer compliance frameworks, and a smaller community of security practitioners building on the platform.

For compliance, Splunk supports SOC 2, HIPAA, PCI-DSS, FedRAMP, ITAR, and other frameworks with pre-built compliance reports. Datadog supports SOC 2, HIPAA, and PCI-DSS, but its compliance coverage is narrower, particularly for government and defense use cases.

Verdict: Splunk leads decisively in security and compliance. If SIEM is a requirement, Splunk (particularly now under Cisco) is the more established choice.

Vendor Lock-in: Both Create Lock-in

Neither Datadog nor Splunk makes it easy to migrate away, and this is an important consideration for long-term platform decisions.

Splunk creates lock-in through SPL. Years of saved searches, dashboards, reports, and alerts are written in a proprietary query language that does not transfer to any other platform. Organizations that have invested heavily in SPL knowledge and Splunk content face significant migration costs, both in rewriting queries and retraining teams.

Datadog creates lock-in through its proprietary agents, dashboard configurations, monitor definitions, and metric naming conventions. While Datadog supports OpenTelemetry for instrumentation, the platform's full feature set (including many APM features, custom metrics, and advanced dashboards) requires Datadog's own agents and libraries.

Neither platform uses SQL or another standard query language as its primary interface. Neither supports exporting your data in a portable format for analysis on other platforms. This proprietary lock-in means that switching costs grow linearly with time and adoption.

Verdict: Both platforms create significant vendor lock-in. Organizations should factor migration costs into their long-term TCO calculations.

Datadog vs Splunk: Quick Comparison Table

When to Choose Each

Choose Datadog When

Datadog is the right choice if your infrastructure is primarily cloud-native, running on AWS, GCP, or Azure with Kubernetes, containers, and serverless functions. Teams that value fast time-to-value and intuitive workflows will appreciate Datadog's onboarding experience, which delivers meaningful monitoring within hours rather than weeks.

If APM and distributed tracing are your primary use cases, Datadog's native APM capabilities are more comprehensive and easier to deploy than Splunk's. SaaS-first organizations that want to avoid managing observability infrastructure will benefit from Datadog's fully managed model.

Datadog is also a strong choice for teams that want a single platform for infrastructure, APM, logs, and RUM, provided the budget supports the combined pricing of all these product lines.

Choose Splunk When

Splunk is the right choice if enterprise SIEM and security analytics are core requirements. Splunk Enterprise Security remains the gold standard for large-scale security operations, and its integration with Cisco's security portfolio only strengthens this position.

If your team needs to perform complex, multi-step log analytics involving joins, statistical computations, and ad-hoc transformations across diverse data sources, SPL's expressiveness is unmatched. Organizations with hybrid or on-premises infrastructure, including legacy systems and network devices, will find Splunk's data collection capabilities more comprehensive.

For industries with strict compliance requirements, particularly government, defense, and financial services, Splunk's broader compliance framework support (FedRAMP, ITAR) and established track record make it the safer choice.

Why Consider Parseable Over Both?

After examining the strengths and weaknesses of both Datadog and Splunk, a clear pattern emerges: both platforms are powerful, but both impose significant costs, vendor lock-in, and operational complexity. This is where Parseable offers a fundamentally different approach.

Cost: The Numbers Speak for Themselves

Parseable's architecture is built on object storage (S3, GCS, MinIO), which means your log storage costs are tied to commodity cloud storage pricing rather than per-GB observability platform licensing. At $0.37/GB on S3 with Parseable's columnar compression (up to 90% compression ratios), the cost difference is staggering.

At 100GB/day, Parseable costs approximately $13,500/year compared to Datadog's $195,000/year and Splunk's $200,000/year. That is a 93% cost reduction compared to Datadog and a 93-99% cost reduction depending on Splunk's specific licensing terms. At 1TB/day, the savings become even more dramatic: Parseable at $135,000/year versus $1.5M+ for Datadog and $2M+ for Splunk.

Architecture: Radical Simplicity

Parseable is a single binary that connects to S3-compatible object storage. That is the entire architecture. There are no forwarders, no indexers, no search heads, no cluster managers, no hot-warm-cold tier configurations, and no dedicated infrastructure teams required to keep the platform running.

Deploy Parseable in 5 minutes with a single Docker command:

docker run -p 8000:8000 \
  parseable/parseable:latest \
  parseable local-store

Compare this to Splunk's multi-component architecture requiring forwarders on every host, indexer clusters with replication, search head pools for query distribution, and deployment servers for configuration management. Or compare it to Datadog's requirement for agents on every host at $15-23/host/month before you even start ingesting data.

Query Language: SQL. Your Team Already Knows It.

Parseable uses SQL as its query language. Not a proprietary query language, not a domain-specific language, just standard SQL that your engineers, analysts, and even product managers already know.

SELECT * FROM app_logs
WHERE level = 'error'
  AND timestamp > NOW() - INTERVAL 1 HOUR
ORDER BY timestamp DESC
LIMIT 100

No learning SPL (Splunk). No learning Datadog's proprietary query syntax. No certification programs. No specialized training. SQL is the most widely known query language in the world, and Parseable leverages that existing knowledge to eliminate onboarding friction.

Open Source: No Vendor Lock-in, Full Transparency

Parseable's source code is available on GitHub. You can inspect every line of code, contribute to the project, and deploy it anywhere, on any cloud, on-premises, or in air-gapped environments. The BYOC (Bring Your Own Cloud) model means your data stays in your infrastructure, under your control.

This is a fundamental philosophical difference from both Datadog (SaaS only, your data lives on their infrastructure) and Splunk (proprietary software with opaque internals). With Parseable, there is no vendor lock-in because your data is stored in standard Parquet format on your own S3 buckets, accessible by any tool that reads Parquet.

Unified Observability at a Fraction of the Cost

Like Datadog and Splunk, Parseable provides unified observability across logs, metrics, and traces in a single platform. But unlike those platforms, it achieves this at a fraction of the cost by leveraging object storage economics and columnar compression. Parseable supports native OTLP (OpenTelemetry Protocol) ingestion, which means you can use standard OpenTelemetry collectors and SDKs, no proprietary agents required.

AI/LLM Observability: Purpose-Built for Modern Workloads

As organizations deploy AI agents, LLM-powered applications, and complex AI pipelines, observability for these workloads becomes critical. Parseable provides purpose-built support for monitoring AI workloads, including tracing LLM calls, monitoring token usage, tracking model latency, and analyzing agent behavior patterns. This is a capability that neither Datadog nor Splunk offer natively with the same depth and cost efficiency.

Getting Started with Parseable

Getting Parseable up and running takes minutes, not days. Here is how to get started:

Quick Start with Docker

docker run -p 8000:8000 \
  parseable/parseable:latest \
  parseable local-store

This starts Parseable with local storage. For production deployments with S3 backend:

docker run -p 8000:8000 \
  -e P_S3_URL=https://s3.amazonaws.com \
  -e P_S3_ACCESS_KEY=your-access-key \
  -e P_S3_SECRET_KEY=your-secret-key \
  -e P_S3_BUCKET=your-bucket \
  -e P_S3_REGION=us-east-1 \
  parseable/parseable:latest \
  parseable s3-store

Send Logs via OpenTelemetry

Configure your OTel Collector to export to Parseable's OTLP endpoint, and start querying with SQL immediately:

SELECT service, level, COUNT(*) as error_count
FROM application_logs
WHERE level = 'error'
  AND timestamp > NOW() - INTERVAL 24 HOUR
GROUP BY service, level
ORDER BY error_count DESC

For detailed deployment guides, Kubernetes Helm charts, and integration tutorials, visit the Parseable documentation.

Key Takeaways

1. Datadog excels at cloud-native APM with intuitive workflows and fast time-to-value, but costs escalate rapidly with host count and data volume.
2. Splunk leads in enterprise security and complex log analytics with SPL's unmatched query power, but requires significant operational investment and carries high licensing costs.
3. Neither platform is affordable at scale: at 100GB/day, both platforms cost approximately $200,000/year, and costs grow linearly (or worse) with data volume.
4. Both create significant vendor lock-in through proprietary query languages, agents, and data formats.
5. Parseable delivers equivalent unified observability (logs, metrics, traces) at 93%+ lower cost by leveraging object storage, columnar compression, and SQL-based querying, all with open-source transparency and zero vendor lock-in.

For organizations that want powerful observability without the six-figure price tag, Parseable offers a compelling alternative worth evaluating.

Frequently Asked Questions

Is Datadog better than Splunk?

It depends on your use case. Datadog is better for cloud-native infrastructure monitoring and APM, offering faster setup and a more intuitive user experience. Splunk is better for enterprise security (SIEM), complex log analytics requiring SPL, and hybrid or on-premises environments. Neither is universally "better"; the right choice depends on your infrastructure, team skills, and primary use cases. If cost is a primary concern, neither platform is ideal at scale, and open-source alternatives like Parseable offer significant savings.

How much does Datadog cost per year?

Datadog's annual cost depends on your usage across its product lines. A mid-size deployment with 50 hosts, 100GB/day log volume, APM, and infrastructure monitoring typically costs $50,000-$100,000/year. Larger enterprises with 200+ hosts and higher data volumes regularly see annual bills of $195,000-$500,000 or more. The modular pricing (per-host, per-GB, per-metric, per-feature) makes it difficult to predict costs accurately, and many organizations report actual costs 2-3x higher than initial estimates.

How much does Splunk cost per GB?

Splunk's cost per GB depends on your licensing tier and total volume commitment. Splunk Enterprise (on-premises) typically costs $150/GB/day/year at list price, with volume discounts available for large commitments. Splunk Cloud ranges from $180-$250/GB/day/year. This means 1 GB/day of log data costs approximately $150-$250 per year. At 100GB/day, you are looking at $150,000-$250,000/year for the core platform alone, before adding premium apps like Enterprise Security.

What is the cheapest alternative to Datadog and Splunk?

Parseable is one of the most cost-effective alternatives to both Datadog and Splunk. Built on object storage (S3) with columnar compression, Parseable delivers unified observability (logs, metrics, traces) at approximately $13,500/year for 100GB/day, compared to $195,000-$200,000/year for Datadog or Splunk. Parseable is open source, uses SQL for queries (no proprietary languages to learn), and supports native OpenTelemetry ingestion. Other alternatives include Grafana/Loki for logs and SigNoz for APM, but Parseable provides the most complete unified platform at the lowest cost.

Can Parseable replace Splunk?

Yes, for most log management and observability use cases, Parseable can replace Splunk. Parseable handles high-volume log ingestion (100+ TB/day), provides fast query performance via SQL on columnar storage, and supports unified logs, metrics, and traces. The key scenario where Parseable may not be a direct replacement is Splunk Enterprise Security (SIEM): if your organization relies heavily on Splunk's SIEM capabilities, correlation rules, and security-specific features, you may need a dedicated SIEM alongside Parseable for observability. For pure observability and log management workloads, Parseable is a strong Splunk replacement at a fraction of the cost.

Is Parseable open source?

Yes, Parseable is open source under the AGPLv3 license. The full source code is available on GitHub. You can self-host Parseable on any cloud provider or on-premises infrastructure. Parseable also offers an enterprise edition with additional features such as SSO, RBAC, audit logs, and premium support, but the core platform including log ingestion, SQL querying, dashboards, alerts, and OpenTelemetry support is fully open source.

What query language does Parseable use?

Parseable uses standard SQL as its primary query language. This is a deliberate design choice: SQL is the most widely known query language in the world, and using it eliminates the learning curve associated with proprietary languages like Splunk's SPL or Datadog's query syntax. You can write standard SQL queries with filters, aggregations, joins, window functions, and time-based operations. This also means your queries are portable and your team's SQL knowledge transfers directly to Parseable.

How does Parseable handle logs, metrics, and traces?

Parseable provides unified ingestion and querying for all three telemetry types. Logs, metrics, and traces are ingested via standard protocols including OTLP (OpenTelemetry Protocol), HTTP, and various collector integrations. All data is stored in columnar Parquet format on object storage (S3, GCS, MinIO), enabling efficient compression and fast analytical queries. You can correlate across signal types using SQL joins, for example joining a trace span with its associated log entries using a shared trace ID. This unified approach eliminates the need for separate tools for each signal type while keeping costs low through object storage economics.