Why Traditional Observability Pricing Breaks the Moment You Give Engineers Agents

The query API is rate-limited per organization, with a secondary per-user ceiling. Concurrent calls against /api/v2/query/timeseries from an agent fleet cross the limit within a single investigation; the SDK backs off, retries, and a five-second run stretches to forty. Metric queries are the surface most agents hit first; log search adds its own ceiling. There is no plan tier that removes the throttle, because it's a capacity control, not a pricing one.

The base tier retains data for eight days. Comparing today's canary against last week's baseline requires Data Plus, which adds an ingest premium and unlocks longer queryability. The agent that reaches into that window is paying twice on the same bytes: once to keep them, again to read them back. NRQL is not free at scale, and the tier structure exists specifically to price the workload of reaching backward.

Splunk Cloud provisions Search Virtual Compute up front. Concurrent SPL queries from an agent exceed the allocation, and searches queue behind existing users. Priority becomes a shared-resource negotiation between the agent, the on-call, and whoever else is running searches; the fix is to buy more SVC, at which point the query workload is a line item that grows with adoption.

Grail meters query cost by the volume of data scanned per DQL statement, in Davis Data Units. An agent that runs a broad time-range query, then filters down, is charged on the whole scan regardless of the size of the result. Optimizing query cost per session is the kind of ongoing tuning a human can do carefully and an agent can't easily do at all.