Wazuh vs Splunk: Self-Hosted SIEM for Homelab Budgets

Reading time: ~12 minutes Audience: Homelabbers and security learners choosing a SIEM

What Is a SIEM?

A Security Information and Event Management (SIEM) system collects, analyzes, and correlates security events from across your infrastructure. Core functions:

Wazuh Overview

What Is Wazuh?

Wazuh is a free, open-source security platform combining:

• SIEM (log analysis, correlation)
• IDS (intrusion detection)
• FIM (file integrity monitoring)
• Vulnerability detection (CVE scanning)
• Configuration assessment (CIS benchmarks)
• Compliance monitoring (GDPR, PCI-DSS, NIST)

Architecture

Cost

Key Features

Splunk Overview

What Is Splunk?

Splunk is the dominant commercial SIEM and observability platform. It offers:

• Splunk Enterprise (self-hosted)
• Splunk Cloud (SaaS)
• Splunk Free (limited to 500MB/day ingestion)

Architecture

Cost

Example: 5GB/day logs = ~$10,000–$12,500/year

Key Features

Head-to-Head Comparison

Docker Deployment

Wazuh Docker Compose

version: "3.8"

services:
  wazuh-manager:
    image: wazuh/wazuh-manager:4.7.0
    container_name: wazuh-manager
    hostname: wazuh-manager
    ports:
      - "1514:1514"
      - "1515:1515"
      - "514:514/udp"
      - "55000:55000"
    volumes:
      - wazuh-api:/var/ossec/api/configuration
      - wazuh-etc:/var/ossec/etc
      - wazuh-logs:/var/ossec/logs
      - wazuh-queue:/var/ossec/queue
      - wazuh-var:/var/ossec/var
      - wazuh-rules:/var/ossec/etc/rules
    restart: unless-stopped

  wazuh-indexer:
    image: wazuh/wazuh-indexer:4.7.0
    container_name: wazuh-indexer
    hostname: wazuh-indexer
    ports:
      - "9200:9200"
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - "bootstrap.memory_lock=true"
      - "plugins.security.ssl.http.pemcert_filepath=/usr/share/wazuh-indexer/certs/indexer.pem"
      - "plugins.security.ssl.http.pemkey_filepath=/usr/share/wazuh-indexer/certs/indexer-key.pem"
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - wazuh-indexer-data:/var/lib/wazuh-indexer
    restart: unless-stopped

  wazuh-dashboard:
    image: wazuh/wazuh-dashboard:4.7.0
    container_name: wazuh-dashboard
    hostname: wazuh-dashboard
    ports:
      - "5601:5601"
    environment:
      - "INDEXER_USERNAME=admin"
      - "INDEXER_PASSWORD=SecretPassword"
      - "WAZUH_API_URL=https://wazuh-manager"
    volumes:
      - wazuh-dashboard-certs:/usr/share/wazuh-dashboard/certs
    depends_on:
      - wazuh-indexer
      - wazuh-manager
    restart: unless-stopped

volumes:
  wazuh-api:
  wazuh-etc:
  wazuh-logs:
  wazuh-queue:
  wazuh-var:
  wazuh-rules:
  wazuh-indexer-data:
  wazuh-dashboard-certs:

Splunk Free Deployment

version: "3.8"

services:
  splunk:
    image: splunk/splunk:latest
    container_name: splunk
    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=***    ports:
      - "8000:8000"
      - "8088:8088"
      - "9997:9997"
    volumes:
      - splunk-data:/opt/splunk/var
    restart: unless-stopped

volumes:
  splunk-data:

Note: Splunk Free is limited to 500MB/day. For more, you need a paid license.

Homelab Learning Value

Wazuh for Learning

Splunk for Learning

When to Choose Wazuh

• Best for: Homelabbers, small businesses, budget-conscious users
• Ideal if: You want a fully functional SIEM at zero cost
• Strength: Free, FIM, vulnerability detection, active response, CIS benchmarks
• Tradeoff: Less enterprise polish, smaller app ecosystem

When to Choose Splunk

• Best for: Enterprise environments, career development, deep analytics
• Ideal if: You need to learn SPL for a security career
• Strength: SPL power, massive ecosystem, enterprise support
• Tradeoff: Prohibitively expensive for homelab use

Conclusion

Summary

For homelab use, Wazuh is the clear choice. It offers 90% of Splunk’s SIEM capabilities at zero cost, with built-in features (FIM, vulnerability detection, CIS benchmarks) that require expensive add-ons in Splunk. Splunk Free’s 500MB/day limit is too restrictive for a multi-device homelab.

Career tip: Learn Wazuh first (covers SIEM fundamentals), then study SPL with Splunk Free if targeting enterprise security roles.

Next Steps

1. Deploy Wazuh via Docker Compose (see config above)
2. Install agents on your homelab servers and workstations
3. Enable MITRE ATT&CK rules in Wazuh Manager
4. Read our Wazuh SIEM setup guide for advanced configuration

Affiliate Opportunities

• Mini PCs: Intel N100 for 24/7 Wazuh server
• Storage: SSDs for log retention
• Books: Security Engineering by Ross Anderson
• Courses: LetsDefend, Blue Team Labs Online

Internal Linking

• wazuh-setup → wazuh-siem-setup.md
• docker → docker-compose-yml-examples.md
• monitoring → docker-monitoring-grafana-prometheus.md
• security → homelab-security-monitoring.md

CTA

• Which SIEM runs your homelab? Wazuh, Splunk, or something else?
• Subscribe for homelab security guides and blue team tutorials.