Wazuh vs Splunk: Which SIEM to Learn and Run in 2026

Wazuh vs Splunk comes down to cost, scale and what you are learning for: Wazuh is a free, open source security platform with agents, detection rules, file integrity monitoring, vulnerability detection and active response built in, so a small SOC or a home lab can run a full SIEM without a licence bill; Splunk is a commercial data platform whose free licence is capped at 500 MB of indexed data a day, on a single instance, with alerting, users and roles switched off. For hands-on threat hunting and detection engineering in your own lab, Wazuh gives you more for nothing. For a job whose advert names Splunk, learn Splunk's Search Processing Language (SPL) as well. The good news is that the analyst skills underneath, from rule logic to ATT&CK mapping and hunting method, carry over between them.

Facts about Wazuh and Splunk Free were read on each vendor's documentation in October 2026. Wazuh and Splunk are their owners' trademarks, used here only to describe the products.

The two products in one page

Wazuh has four parts, set out on its architecture page. Agents on Windows, Linux and macOS endpoints collect logs, file changes and inventory and send them to the Wazuh server on TCP 1514 (enrolment uses 1515). The server decodes events and matches them against rules. The Wazuh indexer stores and searches the results, and the Wazuh dashboard is where analysts search, hunt and build views. Detection rules are XML files; the custom rules guide reserves IDs 100000 to 120000 for your own rules so upgrades never overwrite them.

Splunk Enterprise is a general data platform: it indexes almost any machine data and you search it with SPL. Security content, correlation searches and case management come from Splunk's security products on top. Splunk's own pricing page describes activity-based, workload or ingest pricing for its paid platform, so cost grows with the data and the work you put through it.

Splunk Free: what the free licence really allows

Splunk's documentation page About Splunk Free is clear about the limits, and they matter for anyone planning a lab:

• You can index 500 MB a day, which the page estimates at around 7 GB of storage a month.
• It is for a standalone, single-instance installation only. Distributed search, indexer clustering and deployment management are not available.
• Alerting is not available, and there are no users or roles: anyone who reaches the instance is logged straight in as an administrator.
• Exceed the daily volume and you get a licence warning; three warnings in a rolling 30-day window disable search (indexing continues) until you drop back below three.
• A new installation starts on a 60-day Enterprise Trial licence, which you can switch to Free at any time.

So Splunk Free is fine for learning SPL and practising searches on a modest data set. It cannot fire an alert, which is half of what a SOC analyst practises.

Side by side

Worked example: will the lab fit?

You plan a lab with 25 Windows endpoints running Sysmon with a tuned configuration. Each forwards about 1,200 events an hour, and an average event is about 500 bytes once stored (measure your own; untuned Sysmon can be ten times noisier).

1. Events a day: 25 x 1,200 x 24 = 720,000.
2. Volume a day: 720,000 x 500 bytes = 360,000,000 bytes, about 360 MB.
3. Against Splunk Free: 360 MB is under the 500 MB cap, a margin of 140 MB. Grow to 40 endpoints and the volume becomes 40 x 1,200 x 24 x 500 = 576 MB, over the cap every day, and three such days in 30 disable search.
4. Against Wazuh: the quickstart sizes an all-in-one server for 1 to 25 agents at 4 vCPU, 8 GiB of RAM and 50 GB of storage for 90 days of indexed alerts. Alerts are a slice of events: 20 agents x 3,000 alerts a day x 1.5 KB x 90 days = 8.1 GB, well inside 50 GB. Keeping full archives for hunting multiplies that, so size from your own measured volume.

The point is not that one product is cheaper in every case. It is that the free tier of each has a different ceiling: Splunk Free caps data and removes alerting, while Wazuh caps nothing but asks you to supply and run the hardware.

What carries over between them

Employers hire analysts, not product clicks. The habits below work the same in Wazuh, Splunk, Microsoft Sentinel or any other SIEM:

• Decode first, then detect: no field-based rule or search can match an event that was never parsed into fields.
• Write each detection with a sample that must fire and a sample that must not, and tag it with an ATT&CK technique ID.
• Measure precision. A rule raising 300 alerts a day with 4% true positives drops to 45 alerts at 26.7% precision once one known-good tool is excluded by its exact path, with no true positives lost.
• Hunt from a hypothesis, check the data exists, stack-count rare values and end with a written outcome.
• Keep attack simulations inside an isolated lab you own, from a snapshot you revert afterwards.

The same hunt in each tool

Take one hypothesis: a phishing document on a workstation started PowerShell (ATT&CK T1204.002 followed by T1059.001), which would show as a Sysmon process-creation event (event ID 1) with winword.exe as the parent.

• In Wazuh, open the threat hunting view, filter on the Sysmon process-creation rule group (sysmon_event1), add a filter where data.win.eventdata.parentImage ends with winword.exe, and build a data table split by image and agent name for the last seven days. Turn archives on in a lab, because Wazuh's base Sysmon rules are level 0 and do not raise alerts by themselves.
• In Splunk, with Sysmon data onboarded through a Sysmon add-on, a search such as index=sysmon EventCode=1 | where like(ParentImage, "%winword.exe") | stats count by host, Image does the same job.

Either way the next steps are identical: pivot on the process GUID, the user and a few minutes either side, decide whether it is malicious, and end with an incident, a new rule or a written clean result.

Which to choose

Choose Wazuh when you want a complete, alerting SIEM in a home lab or a small organisation without licence costs, when you need endpoint features such as file integrity monitoring and vulnerability detection in the same tool, or when you are learning detection engineering and want to write and tune rules freely. Choose Splunk when your target employer runs it, when you need its very wide app ecosystem, or when you are practising SPL for a role that will give you a paid environment to work in. Many analysts learn both: Splunk's search language for the interview, Wazuh for the hands-on lab that shows what you can do.

If certificates are part of your plan, read our guide on how to verify a training certificate and our look at what free courses with certificates really cost before you pay anyone.

Learn both, free

The free SOC Analyst Level 2: Threat Hunting with Wazuh course builds a Wazuh 4.14 lab with Windows and Linux agents and Sysmon, then teaches decoders, rules and tuning, ATT&CK v19 mapping, hunts for persistence, LSASS access and lateral movement, file integrity monitoring and active response, and incident handling on NIST SP 800-61 Rev. 3, finishing with a scored Atomic Red Team simulation in an isolated lab. For SPL and Level 1 triage, take SOC Analyst Level 1 with Splunk first.

It is a free course with a verifiable certificate of completion, and anyone can check a certificate on our verification page. It is not affiliated with Wazuh Inc., Splunk, MITRE or NIST. Start the Wazuh threat hunting course in your own lab.

Take the free course

Free

Cybersecurity · Intermediate · Free

SOC Analyst Level 2: Threat Hunting with Wazuh

Free

Cybersecurity · Beginner · Free

SOC Analyst Level 1 with Splunk

Free

Cybersecurity · Beginner · Free

Cybersecurity Fundamentals for Beginners