Keep every log.
Query everything.
Pay once.
Active observability on everything you ship, running in your cloud, on your data, in open format. One-time toll: 2¢/GB ingested. Then never again.
Every team is making one of these. None of them are good.
Keep 1%. Lose the incident that lived in the 99% you dropped.
Truncate to 7 days. Watch postmortems become guesswork.
Archive to Glacier. Wait 12 hours and write Athena queries to find one event.
Sign the renewal. Watch the bill grow 30% YoY while engineers ration their queries.
There's a fifth option. We built it.
Active observability
on everything.
No sampling. No dropping. No going cold. No vendor lock-in.
Your logs go in once. They stay queryable forever.
Dashboards, percentiles, trends, anomalies. All in milliseconds.
Queryable by Athena, Trino, Spark, DuckDB, with or without us.
Active queries hit summaries. Drill-down dereferences URIs to raw. No inverted indexes. No calls home.
We don't run a separate anomaly detector. The compression is the detector.
When we compress your logs into summaries, we use mathematical sketches (t-digests, HyperLogLog, bloom filters) to model the typical shape of your data.
Points that don't fit those models can't be compressed. So we keep them verbatim, with a pointer to the original log line.
By construction. If we summarized it, we modeled it. If we didn't, you have it.
Anomaly volume is bounded by the math: a fixed fraction of the tail per shard.
Range-scan anomalies the way you'd range-scan logs. "Has this spiked before?" in milliseconds.
One-time toll. 2¢ per GB ingested. Then never again.
- ✕ Storage
- ✕ Queries
- ✕ Retention
- ✕ Compute
- ✕ Seats
Once.
- ✓ Raw events in your S3
- ✓ Summaries + anomalies
- ✓ Unlimited queries
- ✓ Open Parquet format
- ✓ No exit cost
Pay once when data crosses the engine. Query it for the next decade for free.
Every other observability vendor charges you again every month for data they ingested years ago. We don't.
50 TB/day. Five years. The numbers don't even rhyme.
Splunk figures based on Enterprise list pricing for cold tier retention at 50 TB/day, before EDP discounts. OBSESC at 2¢/GB ingested + S3 lifecycle (IA → Glacier IR). Bring your contract. We'll redo the math on your terms.
over 5 years. Grows every year. Data you wrote in Y1 still being charged in Y5.
over 5 years. Flat year-over-year. Only grows when you ingest more.
$47M difference. Same retention. Same fidelity. Faster queries.
Keep Splunk for what it's good at. Stop paying for what it isn't.
Same logic holds for Datadog, Elastic, or whatever you're running today. No rip and replace. Cut retention to the window your incumbent actually earns. Tee everything else to OBSESC.
- Last 7 days of data
- Live incident response: SPL against fresh data
- Ad-hoc forensics on novel patterns
- Existing dashboards, alerts, runbooks
- Your team's query-language muscle memory
- Day 8 onward, forever
- Trends, percentiles, capacity planning in milliseconds
- Anomaly history: "has this spiked before?"
- Compliance, audit, postmortem evidence
- 100% retention. No sampling.
Cut Splunk retention from 90 days to 7. Tee everything to OBSESC. Same shipper. Same incident workflow. ~85% lower bill.
If we vanished tomorrow, you'd lose nothing.
If we go away, your data doesn't. If you migrate off us, no export step. If your data team wants to query it directly, they already can.
Open Parquet. Open Iceberg. Open exit.
Marketplace AMI. Running in an afternoon.
Metered through your existing AWS commit. No new vendor onboarding.
You've already cleared AWS. The AMI inherits that perimeter. No SOC 2 dependency, no DPIA, no MSA negotiation, no questionnaire round-trip.
Marketplace charges hit your AWS bill. Often counts toward your EDP. Procurement signs once (for AWS) and never sees us.
AMI runs on your EC2. Data lands in your S3. We don't see your logs. We can't see your logs. There's no us-side infrastructure to compromise.
Only outbound traffic is AWS Marketplace metering. Nothing to allowlist. Nothing to audit. Nothing for your network team to argue about.
Benchmarked to 100 TB on a single instance.
- ✓ 303,559 / 303,559 shard roundtrips verified
- ✓ 4,756,732 / 4,756,732 anomalies persisted
- ✓ 0.0% T-digest estimation error
- ✓ 44 / 44 query suite passed at every scale
Numbers from synthetic event data on a single i4i.4xlarge.
What you get vs. what you have today.
| Splunk | Datadog | Hydrolix | Axiom | OBSESC | |
|---|---|---|---|---|---|
| 100% retention without re-paying | ✕ | ✕ | ~ | ~ | ✓ |
| Storage in your own bucket | ✕ | ~ | ✓ | ✓ | ✓ |
| Queries don't cost extra | ✕ | ✕ | ~ | ~ | ✓ |
| Open format, no exit cost | ✕ | ✕ | ✓ | ~ | ✓ |
| Anomalies surface automatically | ~ | ~ | ✕ | ✕ | ✓ |
| Deploys without security review | ✕ | ~ | ✕ | ~ | ✓ |
We're not trying to replace Splunk. We're trying to make sure you only pay Splunk for the seven days where it earns its keep, and pay us once for everything else.
Less ration, more answer.
"Did we keep last month's traces? Can I afford this query? Is this still in hot storage?"
Run the query. Get the answer. Look back six months. Look back two years.
"We sample auth logs at 10% to fit the budget. Compliance is sweating."
100% retention of every event. Audit-ready by default. Anomalies pre-surfaced.
Splunk renewal up another 30%. Datadog usage alarm hit again. Quarterly observability spend review on the calendar.
One predictable line item, scaled to ingest. No retention surprises. No query overage. No vendor lock-in.
A 30-day POC.
Free. Your data. Your cloud.
AWS Marketplace, your account, free tier for the POC window
Cribl, OTel, Vector, Fluent Bit, Splunk HEC. Keep your existing destination.
We compute summaries, surface anomalies, hold raw in your bucket
If we don't save you 5× on the cold tier, you walk away. Keep your data.