Splunk On-Call vs Regen

VictorOps built a genuinely good on-call product before Splunk bought it in 2018: ChatOps-first incident collaboration, a rules engine for routing and enriching alerts, and machine-learning-based responder suggestions that were ahead of most of the category at the time. For a team already standardized on Splunk for logs and monitoring, the Splunk integration for Splunk On-Call is a real, still-supported advantage: alerts flow in without a third-party connector to maintain.

Regen covers the same core on-call mechanics without requiring a Splunk stack underneath it: an incident lifecycle with an immutable timeline, escalation policies with multi-step timeouts, and alert ingestion from Prometheus Alertmanager, Grafana, AWS CloudWatch and generic webhooks, on top of Prometheus, Grafana, Datadog, Slack, Teams and 700+ other integrations. On-call schedules support rotations, overrides, holidays, exceptions and leave, with global timezone support and a multi-lingual interface on the SaaS and Enterprise tiers.

Splunk bought VictorOps in 2018 and renamed it Splunk On-Call. Cisco then closed its roughly $28 billion acquisition of Splunk itself on March 18, 2024, so the on-call product now sits inside a company two ownership changes removed from the team that built it. Its documentation has been folded accordingly: the same integration pages now live under both Splunk Enterprise's "Alert and Respond" section and Splunk Observability Cloud's "On-Call" monitoring section, rather than a single standalone product tree.

That repositioning shows up in the numbers. PeerSpot's category tracking put Splunk On-Call's mindshare in IT alerting and incident management at 3.5% as of September 2026, down from 4.5% a year earlier, ranked ninth in the category. Complaints about slow feature development go back further than that: a 2021 Capterra review already described the product as "left to rot on the vine" since the Splunk acquisition, citing virtually no new features and an SSO setup that stayed awkward for years. Splunk On-Call is not shutting down. It is also clearly not the roadmap priority it once was as an independent company.

Working from the tiers third-party aggregators still list, a 50-person team on Enterprise at $45 a seat monthly runs $2,250 a month, about $27,000 a year. Splunk's own site no longer confirms or denies that figure since the dedicated pricing page is gone; the one number it does publish, $5 a user monthly for up to 10 seats billed annually on the general observability pricing page, only covers a small team and doesn't say what happens past 10 seats without a sales call.

Regen's Pro plan is a flat $100 a month for a 50-person team, about $1,200 a year, with no per-seat multiplier and no cap on users, incidents, schedules or AI usage. The open-source tier runs the same way self-hosted, at $0, and the pricing page it's quoted from has not moved.

SSO for Splunk On-Call is still explicitly labeled a beta. Splunk's own documentation on SCIM and Okta provisioning states plainly that setup "is currently not a self-service process and requires contacting the Support team," and warns the release "may contain defects or deficiencies." Regen ships SSO and SAML 2.0 for Okta, Azure AD, Google Workspace and any compliant identity provider, self-service, free on every tier including the open-source one.

Splunk On-Call's post-incident review feature generates a timeline and MTTA/MTTR metrics, but writing the actual post-mortem narrative is still a manual step: reconstructing what happened from that timeline, Slack messages and call notes. Regen generates the narrative itself. Incident summaries, post-mortems and handoff digests are written automatically and synced back to Slack and Teams, on a model key you bring yourself, OpenAI, Anthropic or Ollama, and it isn't a separate line item on any tier.

Regen's one-click migration list currently covers Grafana OnCall, Opsgenie and PagerDuty: schedules and escalation policies import directly, no dedicated Splunk On-Call importer yet. Moving off Splunk On-Call today means rebuilding schedules and escalation paths by hand or via Regen's API, not a one-click pull. Given how far Splunk On-Call has receded from active development, and how little of its own roadmap Splunk is publishing for it, teams evaluating a move are generally doing so because the tool has stopped moving, not because of a feature they'd be giving up.