The Breaking Point for Observability Leaders
Observability is at a crossroads
For years, observability has promised to give teams the visibility they need to keep digital services resilient. But as data volumes explode, many leaders are realizing the tools they rely on aren’t keeping up. Costs are rising year over year, while satisfaction with observability cost-to-value is falling.
Instead of delivering agility, today’s observability platforms are forcing painful trade-offs — between cost and coverage, speed and scale, insight and affordability.
That’s the story behind The Breaking Point for Observability Leaders, a new research report from Imply based on a survey of senior executives responsible for observability across large enterprises.
The results point to a clear conclusion: observability is reaching a breaking point.
Rising costs, shrinking value
Budgets are climbing, but confidence is falling.
- 62% of leaders now spend more than a quarter of their observability budget on a single platform.
- Only 13% describe themselves as “very satisfied” with the cost-to-value ratio of their current observability tools.
One respondent put it bluntly:
“Splunk’s licensing model is a tax on growth. Every new use case just means higher spend.”
Organizations are investing more in observability every year — but confidence is slipping. Instead of helping teams move faster, observability has become a source of friction, frustration, and financial strain.
The trade-offs leaders face
In an ideal world, teams could retain and search all their observability data without worrying about cost constraints.
But for most leaders, cost pressure shows up in familiar ways — filtering logs, archiving to cold storage, or offloading data entirely.
In fact, nearly 80% admit they filter, archive, or offload logs just to stay within budget.
And 87% say slow queries caused by inaccessible data disrupt critical use cases like incident response and threat detection.
As one IT manager put it:
“We push more data to cold storage than we’d like, and we filter out logs that might be valuable later — just to keep costs in check.”
The result is slower investigations, growing blind spots, and weakened operational resilience.
In a field where every second counts, those trade-offs can spell the difference between detection and disruption.
Searching for alternatives
Despite these frustrations, most leaders aren’t ready to rip and replace their observability stack. Familiar workflows matter. But the appetite for change is undeniable:
- 87% are actively exploring or open to alternatives to their current platform.
- 98% say they would adopt a fully compatible option if it could ease cost and scale pressures without disrupting existing tools or workflows.
As one security leader explained:
“If something gave us the same search experience with better economics, we’d be all over it.”
Compatibility — not complexity — is what leaders want next.
Why this matters now
The future of observability depends on breaking the cycle of rising costs and shrinking visibility as data volumes continue to accelerate.
Leaders can no longer afford to sacrifice retention, speed, or coverage just to manage their bills.
As data volumes continue to grow, the industry faces a defining question:
How do we scale observability without sacrificing data retention, query performance, or coverage?
Do we keep trimming data to fit the cost model?
Or do we rethink the architecture altogether?
The next phase of observability will be shaped by how leaders respond to these pressures today.
Read the full report
This blog only scratches the surface of what observability leaders are experiencing today.
Download the full Breaking Point for Observability Leaders report to see all the data, including how executives are adapting, what trade-offs they’re making, and what they want most from their next generation of tools.
Related articles
More from Imply on the same topic.
Search your Splunk DDSS archive without restoring it
Security teams often keep logs long after they have aged out of their SIEM platform’s searchable window. The data is there for investigations or audits, but accessing the data for insights can be complicated.
Claude makes dashboards now, Lumi is ready for them
This week Anthropic launched Claude Dashboards in beta. You connect a data source, ask a question in plain language, and Claude writes the queries and builds the dashboard.
Lumi Lounge Recap: 3 Takeaways from Splunk .conf26
The Imply Lumi Lounge sat directly across the street from Splunk .conf26 and reached venue capacity on both days. Digital signs around the Colorado Convention Center pointed attendees our way with a simple message: “Federated search, done right. Full SPL. Less spend.”
Agents don’t query like your detections do
A security team of four has run a major SIEM since February. Nobody on the team writes SPL. Nobody opens the console or looks at the dashboards. Every question goes through an AI agent, which writes the query, runs it, reads the result, and answers in plain language.
Why You Shouldn’t Have to Delete Your VPC Flow Logs
When a security incident happens, investigators almost always start with the same questions: Which systems communicated? Where did the traffic originate? What changed before the incident? Was data exfiltrated? AWS VPC Flow Logs are often the fastest way to answer those questions.
Splunk Smartstore vs Lumi Loglake: Two Very Different Ways to Search Logs in Object Storage
One copies data back before it can be searched. The other queries it where it lives. Lumi Loglake lets Splunk teams query logs directly in object storage, including AWS S3, Delta Lake, Apache Iceberg, using standard SPL.
Supercharging Schema-On-Read: Logs in Object Storage Don’t Need a Data Catalog
Machine data architectures are rapidly changing. As telemetry volumes continue to grow and as costs rise, organizations are increasingly moving logs and other machine data into object stores such as AWS S3.
Imply Lumi Loglake vs Splunk Federated Search for S3
Teams are increasingly moving log data into AWS S3 to reduce costs and extend retention. Both Lumi Loglake and Splunk Federated Search to S3 help you query data in AWS S3 to lower costs, however the two technologies have several notable differences.
A First Look at Lumi Loglake: Query Logs Where They Live
TL;DR: Imply Lumi Loglake is a lakehouse (separated compute/storage) architecture for unstructured logs that reduces costs from 40% up to orders of magnitude on your hardware/AWS/Azure bill used to run your SIEM/observability products.
Imply Lumi Major Release Preview: Continuing the Journey Towards Decoupled Observability/SIEM
We are getting ready to introduce the next major expansion of Imply Lumi and the observability warehouse. When we introduced the industry’s first observability warehouse, the goal was clear: decouple the observability stack by separating storage, compute, and access.
Query Lumi from Grafana: Now in Private Preview
Observability has a silo problem. Today, we’re removing another one. Imply Lumi’s Grafana Loki integration is now in Private Preview.
