PagerDuty vs Splunk On-Call

Feature comparison

PagerDuty and Splunk On-Call (formerly VictorOps, acquired by Splunk in 2018 and now under Cisco following the 2024 Splunk acquisition) both provide enterprise on-call, escalation, and incident-response workflow. The architectural philosophies and ecosystem alignments diverge meaningfully.

PagerDuty offers a broader operations cloud. Beyond core on-call and escalation, the platform delivers Event Intelligence for AIOps-style alert grouping and change correlation, Process Automation (formerly Rundeck) for runbook execution, Customer Service Operations for incident-impact workflow, and Status Pages for external communication. The integration catalogue exceeds 700 monitoring and ITSM tools and is widely regarded as the deepest in the category. PagerDuty Copilot has added generative-AI assistance for incident summarisation and responder context.

Splunk On-Call retains the VictorOps heritage of ChatOps-led incident response. The Timeline view, transcript-based collaboration, and tight integration with Splunk Enterprise and Splunk Observability are the central buying arguments. Post-Cisco acquisition, Splunk On-Call has been positioned inside the Cisco Full-Stack Observability narrative alongside AppDynamics and ThousandEyes, although integration depth across that portfolio remains uneven. The roadmap pace has been observably slower than PagerDuty's during the post-acquisition period.

For AIOps, PagerDuty Event Intelligence is generally regarded as the more mature offering. Splunk On-Call relies on Splunk ITSI for upstream event correlation rather than embedding AIOps in the on-call product itself, which suits Splunk-standardised estates but may not suit organisations wanting AIOps decoupled from log management.

For audit and compliance, PagerDuty offers FedRAMP Moderate, HIPAA, SOC 2 Type 2, and ISO 27001. Splunk On-Call inherits Splunk Cloud's compliance posture, which includes SOC 2 Type 2, HIPAA, and FedRAMP options for the underlying Splunk Cloud Platform. Validate the on-call product specifically rather than the parent platform during procurement.

Pricing comparison

PagerDuty lists Professional at $21 per user per month, Business at $41 per user per month, and Digital Operations at custom pricing as of May 2026. Event Intelligence and Process Automation are paid add-ons or bundled in Digital Operations. A 200-responder enterprise deployment with Event Intelligence typically lands in the $150K–280K range annually before negotiation. Customer Service Operations is licensed separately and meaningfully expands the deal size where adopted.

Splunk On-Call lists Starter at $5, Growth at $14, and Enterprise at $29 per user per month. A 200-responder Enterprise deployment typically runs $60K–80K annually as a standalone purchase, but Splunk-bundled procurement is now the more common path; enterprise Splunk customers often acquire On-Call through Workload Pricing or as an add-on to Splunk Observability Cloud. Buyer-side caveat: Splunk-bundled commercial terms can obscure the marginal cost of On-Call and may carry indirect-access implications where alerts traverse the broader Splunk indexer footprint. PagerDuty buyers should price-model the operations-cloud add-ons carefully, since Event Intelligence, Customer Service, and Process Automation can each add 30 to 60 percent to the base contract.

When to choose PagerDuty

Choose PagerDuty when the buyer wants the broader operations cloud with AIOps event intelligence, runbook automation, and customer-service-operations workflow, when integration breadth across heterogeneous monitoring and ITSM tools is critical, and when on-call is the entry point to a wider operations transformation. It fits large SRE organisations standardising incident response across many teams, regulated industries needing FedRAMP Moderate, and enterprises that do not have Splunk as the strategic observability platform.

When to choose Splunk On-Call

Choose Splunk On-Call when the organisation has already standardised on Splunk Enterprise, Splunk Observability Cloud, or Splunk ITSI, when ChatOps-led incident response with the VictorOps Timeline experience matches the existing operating model, and when commercial bundling through Splunk procurement provides materially better economics. It fits Splunk-aligned SRE and IT operations teams, regulated industries already running Splunk Cloud with established compliance posture, and organisations that prefer to keep AIOps in Splunk ITSI rather than in the on-call platform itself.

Alternatives to both