What is Splunk Agent Observability?
Splunk Agent Observability is the product formerly called Galileo (galileo.ai). Cisco announced it would buy Galileo Technologies on 9 April 2026 and completed the deal on 22 May; according to Galileo's release notes, Galileo became Splunk Agent Observability on 7 August 2026. The old galileo.ai pricing page now redirects to Splunk's.
It records each step of an AI agent as a trace (model calls, tool calls, retrieval) and scores those traces with built-in and custom evaluators for correctness, tool use, RAG quality and safety. Its distinctive part is Luna, a family of small judge models that Splunk says return a verdict in about 152 ms at around $0.15 per million tokens, against about 3,200 ms and $5.00 for a frontier model. Evaluators you trust can be turned into runtime guardrails that block prompt injection, PII leakage and tool misuse; Galileo's older Protect feature was deprecated in June 2026 in favour of Agent Control. A Tokenomics view tracks token cost by request, model, agent and workflow.
It runs as part of Splunk Observability Cloud (US, EU, Australia and Japan regions) or on-premises, including air-gapped. Splunk lists it from $100 a month per 1.2 million spans a year, billed annually, with 500 million Luna tokens and 5 Luna fine-tuning runs a year included; access to the full product goes through the Splunk sales team.
How much does Splunk Agent Observability cost?
| Plan | Price | What you get |
|---|---|---|
| Observability Cloud Free Edition | Free | Up to 15 hosts, no expiry; agent tracing included |
| Agent Observability | From $100/month, billed annually | Per 1.2M spans a year; 500M Luna tokens and 5 Luna fine-tuning runs a year |
Agent Observability from $100/month per 1.2M spans a year, billed annually, including 500M Luna tokens and 5 Luna fine-tuning runs a year; extra Luna tokens and longer retention by quote. Splunk Observability Cloud Free Edition (up to 15 hosts, no expiry) includes agent tracing. Galileo's old Free (5,000 traces/month) and Pro ($100/month billed yearly, 50,000 traces) plans are no longer published.
Is Splunk Agent Observability worth it?
If you check your AI agent's answers by asking a big model to grade them, the grading bill soon rivals the agent's own. So most teams sample a few per cent of conversations and hope the rest look the same.
Galileo's answer was Luna: small models trained only to judge, which Splunk says are 98% cheaper than using a frontier model as the judge and fast enough to block a bad tool call before it fires. That is still the reason to look at this product. Its guardrails are built on the same models, so a check you trust in testing can stop prompt injection or a leaked card number in production rather than flagging it afterwards.
The rest is a solid tracing and evaluation tool: traces of every model, tool and retrieval step, preset evaluators for agents, RAG and text-to-SQL, experiments against datasets, annotation queues and a cost view. Since Cisco bought Galileo in May 2026 and renamed it on 7 August, it also sits inside Splunk Observability Cloud, so a slow agent can be traced to the GPU or database behind it, much as Datadog does for its own customers.
The catch: the parts that made Galileo distinctive are the parts that are hardest to get. Splunk's Luna docs say Luna models are only available in the Enterprise tier, and the hosted version supports just five preset Luna evaluators, with no Luna fine-tuning or custom code evaluators; those need the on-premises install. The Splunk Observability Cloud release notes say you contact support for access. The published price, from $100 a month per 1.2 million spans a year, is a starting point, not a rate card. Galileo's old Free plan of 5,000 traces a month and its $100 Pro plan are no longer published, and Splunk has not said what renewals look like for customers who joined before 7 August; their documentation stays on docs.galileo.ai for now. Anyone who built on Protect also has a migration to Agent Control ahead.
Our take: the judge models are the reason to choose it, and they are now sold the way Splunk sells everything else. A team already paying Splunk for observability should ask for a quote; a ten-person startup that wants to sign up and start scoring this afternoon will be happier with Braintrust or LangSmith.
Where it earns its place
A platform team at a bank already running Splunk Observability Cloud
Stop the customer-service agent leaking card numbers or following injected instructions
Preset Luna evaluators for PII and prompt injection run as guardrails on every request; Splunk says Luna returns a verdict in about 152 ms, so the check can block a reply before it is sent. Pricing is by annual quote.
An AI quality lead at a healthcare software company
Score every production conversation instead of a small sample
Luna judges at a quoted $0.15 per million tokens, against about $5.00 for a frontier judge, make full coverage affordable. Training a Luna model on the company's own labels needs roughly 4,000 examples and the on-premises or Enterprise setup.
An engineering manager on a legacy Galileo contract
Work out what the Splunk rename means before renewal
Existing workspaces and docs.galileo.ai keep working for customers who joined before 7 August 2026. Ask Splunk for renewal pricing, data processing terms and a timeline for moving Protect rules to Agent Control.
Before you commit
- Setup
- Request access through the Splunk team, then select Agent Observability in the Observability Cloud menu; the quickstart says a first trace takes under 5 minutes with the Python SDK, an agent framework integration or the REST API.
- Integrations
- OpenAI and the OpenAI Agents SDK, Anthropic Claude, LangChain and LangGraph, CrewAI, Google ADK, Pydantic AI, Strands, Microsoft Agent Framework, Amazon Bedrock, NVIDIA NIM; OpenTelemetry and OpenInference; MCP server for Cursor and VS Code.
- Data and privacy
- Hosted traces kept 30 days by default, extendable to 60, 90 or 180; experiment data 2 years. Hosted regions in the US, EU (eu-west-1), Australia and Japan; on-premises and air-gapped installs available. Galileo states SOC 2 Type II and signs HIPAA BAAs; Splunk has not published product-specific certifications or whether trace data is used for training.
- Cost at scale
- Not published beyond the starting price of $100 a month per 1.2 million spans a year, billed annually. Splunk bills on agentic spans plus Luna tokens, with Luna billing set by each subscription agreement.
- Limits
- Hosted ingestion defaults to 5 MB of trace data per minute per purchased unit, and spans past the limit are dropped. Luna fine-tuning and code-based evaluators are on-premises only; Luna-3 is not available in the Japan region.
What’s good
- Luna judge models make it affordable to score all traffic, not a sample
- Evaluators double as runtime guardrails that block, not just flag
- Agent traces linked to Splunk APM and infrastructure data
- On-premises and air-gapped installs available
- Preset evaluators for agents, RAG, safety and text-to-SQL
What’s not
- Luna is Enterprise-only, and the hosted version supports only five preset Luna evaluators
- Access through Splunk support or sales; no self-serve rate card
- Galileo's published Free and Pro plans are gone
- Renewal terms for existing Galileo customers not published
- Protect deprecated; guardrail users must move to Agent Control
Best for
Large organisations already on Splunk Observability that want to score every agent conversation and block unsafe actions at runtime.
Splunk Agent Observability alternatives
Splunk Agent Observability: common questions
- Is Splunk Agent Observability worth it?
- Galileo's small judge models make it cheap to score every agent conversation, but under Splunk it has become an enterprise purchase with a sales call in front of it. We rate it 3.7 out of 5.
- How much does Splunk Agent Observability cost?
- Agent Observability from $100/month per 1.2M spans a year, billed annually, including 500M Luna tokens and 5 Luna fine-tuning runs a year; extra Luna tokens and longer retention by quote. Splunk Observability Cloud Free Edition (up to 15 hosts, no expiry) includes agent tracing. Galileo's old Free (5,000 traces/month) and Pro ($100/month billed yearly, 50,000 traces) plans are no longer published.
- What are the downsides of Splunk Agent Observability?
- Luna is Enterprise-only, and the hosted version supports only five preset Luna evaluators; access through Splunk support or sales; no self-serve rate card; galileo's published Free and Pro plans are gone; renewal terms for existing Galileo customers not published; protect deprecated; guardrail users must move to Agent Control.
- Who is Splunk Agent Observability best for?
- Large organisations already on Splunk Observability that want to score every agent conversation and block unsafe actions at runtime.
- How much does Splunk Agent Observability cost for a team or in production?
- Not published beyond the starting price of $100 a month per 1.2 million spans a year, billed annually. Splunk bills on agentic spans plus Luna tokens, with Luna billing set by each subscription agreement.
- Is Splunk Agent Observability safe for company data?
- Hosted traces kept 30 days by default, extendable to 60, 90 or 180; experiment data 2 years. Hosted regions in the US, EU (eu-west-1), Australia and Japan; on-premises and air-gapped installs available. Galileo states SOC 2 Type II and signs HIPAA BAAs; Splunk has not published product-specific certifications or whether trace data is used for training.
- What are the best Splunk Agent Observability alternatives?
- The closest alternatives we have reviewed are Datadog LLM Observability, LangSmith, Braintrust and Arize AX.
Answers checked Nov 2, 2026.