Datadog, Splunk, Snowflake: Three Levers for Usage-Priced Contracts

A 10,000-host Datadog fleet ingesting 500 GB of logs a day runs roughly $175,000-$210,000 a month on Pro at list. Call it $2.1M a year as the conservative anchor, and the seat-compression playbook gets you nothing on it — there are no seats to drop. The hosts are real, the logs are real, the bill is real. Tell your IdP-driven SaaS-spend dashboard about it and it'll mark the row "100% utilized" or "no compression lever" and move on.

The compression is there. It just lives in three places that don't show up in a Zylo report: the pre-commit discount on your renewal paper, the sample-and-retention tuning inside the tool, and the tier ladder you may not have noticed you over-bought. On the Datadog example, the three levers together can take that $2.1M down to roughly $1.14M-$1.4M — call it $700K-$960K of annual savings, and call it that carefully because the levers compound rather than stacking additively.

This post is the methodology. Datadog is the worked example because the demo catalog ships an $8K/mo Datadog row at 25/30 hosts and the math reads cleanly. Splunk and Snowflake follow the same shape with different knobs.

Try the free calculator — 15 seconds, no signup.

Why usage-priced contracts break the seat formula

The SeatCompress engine treats Datadog as pricingModel: "usage" and zeros the seat-utilization decomposition for that row. That isn't a bug in the dashboard — it's the contract. Datadog's public pricing page lists Infrastructure Pro at $15 per host per month and Enterprise at $23, with APM at $31 and $40 respectively. Log ingest is priced per million events plus per GB retention. None of those denominators are seats. A 30-host setup with 25 active engineers isn't "five wasted seats" — the bill scaled on the 30 hosts, not the engineering accounts that can log into the UI.

Splunk is the same shape. The catalog description reads "no per-seat SKU — pricing is TB/day-ingest or SVC-based." The $150/seat in the catalog is a notional admin reference so the row renders alongside the rest of the stack; the engine doesn't actually compute seat compression off it.

Snowflake bills credits — units of compute consumed by warehouse-hours. Standard / Enterprise / Business Critical run at roughly 1× / 1.5× / 2× on most public quotes. The "seat" concept barely exists; what you're buying is compute time on a tier.

We covered the broader framework in Dimensional SaaS Compression — per-seat compression is one of four pricing dimensions, and the legacy spend dashboards render the other three as zero. This post is the lever inventory for the one labeled "usage."

The Datadog worked example: $2.1M/year, three levers

Take an enterprise platform team running 10,000 monitored hosts on Datadog Pro at roughly $15/host/mo for Infrastructure plus a meaningful log ingest line — call it 500 GB/day of mixed application and security logs. Numbers from the public pricing page; the exact blend will differ in your contract but the orders of magnitude won't.

• Infrastructure: 10,000 hosts × $15 = $150,000/mo on Pro alone, $1.8M/yr standalone.
• Logs: at 500 GB/day, ingest plus 15-day retention plus indexed analytics typically lands in the $30K-$60K/mo range depending on event volume and archive policy. Midpoint $50K/mo, $600K/yr. Logs are roughly half of most Datadog bills above 1,000 hosts.
• APM (typical adder on prod-tier subset): real customers layer APM (a $31-$40 per-host adder), Synthetics, RUM, and CSM. APM on ~50% of hosts at $31 would be ~$155K/mo standalone; most enterprises pin it to a prod subset, so call it ~$25K/mo, $300K/yr as a conservative typical.

Sum the list-price lines and you're at ~$2.7M/yr. Not every enterprise layers everything, so use $2.1M/yr as the conservative hero — infra + logs only, with APM partially loaded — paid month-to-month with no committed-use discount on the paper. That's the starting point.

Lever 1: Pre-commit discount at renewal

Datadog's pay-as-you-go pricing carries a premium relative to annual commit. Customer reports cluster around 20-30% off list for a one-year commit and 30-40% for a multi-year commit at sufficient scale. Twenty-five percent as the conservative anchor: $2.1M × 0.75 = $1.575M/yr. That's $525K saved before you touch a single configuration knob.

The mechanics matter. The discount applies to committed usage. If you commit to 12,000 host-months and only consume 10,000, you've eaten the difference at full list. Underestimate the commit and you pay overage at PAYG rates (giving back some of the 25%); overestimate and you've paid for capacity you didn't use. Two-year commits unlock more discount but lock the forecast longer. Most procurement teams split the difference at 12-month committed with quarterly true-ups.

This lever fires first because it discounts list, and every downstream lever operates on the post-commit bill.

Lever 2: Sample and retention tuning

Datadog charges twice on logs: ingest (per million events plus per GB) and indexed retention (longer retention costs more). Most enterprise log volume is INFO-level noise that's never queried after the first 24 hours and serves no compliance purpose. The CFO question is: of the 500 GB/day you're ingesting, how much does Security actually need indexed-and-queryable for 15 days, and how much would be fine in a hot tier for 24 hours then archived?

A typical pattern: ERROR and WARN logs index full retention; INFO and DEBUG get sampled at 30-50% and rolled to archive at 24-48 hours. That cuts ingest by something like 60% on the INFO/DEBUG band. Logs are about half the bill at this scale, and INFO/DEBUG is about half of log volume — so a 60% reduction on that sub-band lands at roughly 60% × 50% × 50% = 15% off the post-commit residual — another $236K/yr off the $1.575M figure.

Splunk has the same tunable surface. Index volume is the load-bearing input; the lever is what gets routed to a paid index versus an archived bucket. Splunk bills routinely drop 25-40% after a serious cardinality and ingest audit, and the audit usually pays for itself in the first quarter. Critically, this is not a renewal-only lever — sample and retention tuning lands savings immediately, which is why it's the lever to pull before the renewal conversation, not after.

Snowflake's version is warehouse sizing plus auto-suspend tuning plus materialized view selection. A Large warehouse running constantly versus an X-Small that auto-suspends after 60 seconds of idle is the same lever — credits consumed per query. A poorly-tuned BI dashboard hammering a warehouse all day on Snowflake Enterprise can run 5-10× what a sized-down Standard warehouse with caching would cost for the same workload.

Lever 3: Tier downgrade

Datadog ladders Free / Pro / Enterprise. Snowflake ladders Standard / Enterprise / Business Critical. The question on either is whether your whole fleet needs the top tier, or whether non-prod and lower-criticality environments can sit on a cheaper one. Most engineering orgs over-buy the top tier because initial procurement bundled it for prod-grade SLOs, then nobody downgrades the dev/staging hosts that came along for the ride.

A common shape: 30% of the host fleet is non-prod and doesn't need the full Pro instrumentation. Moving 30% of 10,000 hosts to an instrument-only configuration or de-instrumenting them entirely takes $15/host/mo off the bill — 3,000 hosts × $15 = $45,000/mo gross in isolation, $540K/yr at list. (Datadog Free is capped at 5 hosts per their public pricing page — it isn't a 3,000-host destination. The real path is downgrade to a basic Infra-only SKU, drop APM / Synthetics / RUM / CSM from non-prod hosts, or unmonitor the lowest-tier dev fleet entirely.) The math compounds backwards through Levers 1 and 2, so the actual Lever-3 contribution against a post-commit, post-sample residual of $1.339M/yr lands at roughly $201K/yr (~15% of residual) at the conservative end.

Snowflake tier downgrades work the same way for non-PII / non-regulated workloads. Business Critical is a 2× multiplier over Standard; if your dev environment doesn't process PHI or run inside a regulated VPC, it doesn't need the BC SKU.

The overlap problem: levers compound, they don't add

Add up the headline savings naively — using gross figures at the original $2.1M base — and you get $525K + $236K + $540K = $1.301M against a $2.1M bill. That's 62%, which sounds plausible until you stack a fourth lever and watch the number tip past 80%. The additive answer overstates the truth by roughly 36% here.

We learned this the hard way on our AI Spend right-sizing calculator. The first version stacked the five levers additively. Code review caught that a worst-case Anthropic-heavy scenario computed to 151% of bill — the calculator was telling CFOs they could save more than they were spending. Embarrassing, and methodologically indefensible.

The fix on that calculator was sequential-residual stacking: levers fire in deterministic order, and each one operates on the spend remaining after upstream levers have already discounted the base. Lever 1 takes 25% off the full $2.1M (residual: $1.575M). Lever 2 takes ~15% off $1.575M, not off $2.1M — that's $236K saved. Lever 3 takes its tier-downgrade share of what's left, not its share of the original list.

Run Datadog through the same gate:

• Lever 1 (commit): 25% × $2.1M = $525K. Residual: $1.575M.
• Lever 2 (sample/retention): 15% × $1.575M = $236K. Residual: $1.339M.
• Lever 3 (tier downgrade): ~15% × $1.339M = $201K. Residual: $1.138M.

Sequential-residual total: roughly $962K/yr against the $2.1M bill. That's ~46% — close to the additive answer but bounded by construction. The honest CFO presentation quotes a range: ~$700K-$960K depending on how aggressive your sample policy turns out to be and how much of your fleet really can run on the cheaper tier. Don't make the additive mistake. We did, and so will every spreadsheet that doesn't explicitly model the residual.

Where Vantage and CloudZero fit (and don't)

Two products in this category deserve their flowers: Vantage and CloudZero. Both do excellent cost-allocation, anomaly detection, and tagging work on cloud and SaaS spend. If you don't know which team's Datadog usage is driving the bill up month over month, Vantage will tell you. If your Snowflake warehouse spending is anomalous against last quarter, CloudZero will flag it.

What they don't do is tell you the renegotiation lever. Knowing that team A drives 60% of the log ingest is upstream of the savings — it tells you who to bring into the room. It doesn't tell you that the lever is a multi-year commit with quarterly true-ups, that sample-and-retention is the immediate $236K, and that 30% of your fleet can drop a tier. FinOps tools sit on the engineering side of the line: where is spend, why is it spiking, which workload is responsible. SeatCompress sits on the finance side: what's the line item, what's the contract structure, what do I negotiate at renewal.

Both perspectives matter. Most enterprises will run a FinOps tool and a SaaS-spend tool in parallel because the questions they answer are orthogonal. The dashboard you use to find runaway Snowflake warehouses isn't the same one you use to draft the renegotiation playbook for next quarter's renewal — different jobs, different cadences, different people.

The Vendr / Zylo / Tropic / Productiv category is the closer competitive set. Our take in the Zylo vs Vendr vs Productiv breakdown is that their commercial model rewards keeping the headline number high. SeatCompress models contracts the same way for usage-priced rows that it does for per-seat, per-employee, and per-device — same pricing-model gate, same anti-fabrication trust contract on every $ figure, same renewal-deadline pressure surface. We covered the renewal-pressure mechanic in The Hidden Cost of Auto-Renewal Clauses and the per-device dimensional sibling in the CrowdStrike breakdown.

How to run this on your own contract

Four steps, roughly half a day of finance-plus-engineering time.

Step 1: Pull the bill detail. Datadog, Splunk, and Snowflake all export usage by sub-account, host, index, or warehouse. You want a 3-month view broken down by category (infra vs logs vs APM for Datadog; index vs license utilization for Splunk; warehouse-hours per warehouse for Snowflake). Most bills have one or two line items doing 60-70% of the damage and a long tail.

Step 2: Score Lever 1. Is your contract on PAYG, an existing commit, or somewhere in between? If PAYG, the commit lever is wide open. If you're already on a 12-month commit and renewal is more than 6 months out, the lever is dormant until the next renegotiation. If renewal is inside 90 days, this is the lever to pull first.

Step 3: Score Lever 2 against the dollar-weighted mix. Look at the biggest line item. For Datadog, that's usually logs and APM. For Splunk, ingest volume per source. For Snowflake, the noisiest warehouse. Then ask: what's the policy change that cuts that line by 30-50% without breaking the operational use case?

Step 4: Score Lever 3. Walk the host/warehouse list and tag each as prod, non-prod, or stretch. Anything non-prod is a downgrade candidate unless there's a written reason. Stretch goes on the watch list for next renewal.

Add the levers using residuals, not raw percentages. Quote the range, not the optimistic point estimate. If you don't, the next person down the table will ask why the savings number didn't materialize on the post-renegotiation P&L.

The bottom line

Usage-priced tools aren't outside the SaaS compression frame — they sit inside it, on a different lever. Per-seat compression is what built the SaaS-management category; pretending the rest of the stack is in scope when your engine zeros it is the legacy spend dashboard's tell. We took the opposite path: the engine routes usage-priced rows through the pricing-model gate, the dashboard renders the $0/seat figure honestly with a "usage-priced" badge, and the renegotiation playbook for these rows lives in the three-lever framework above instead of in the unused-seats column that doesn't apply.

For Datadog, Splunk, and Snowflake specifically, the addressable savings sit between 25% and 50% of contract value depending on aggression, mix, and how clean the post-commit forecast turns out to be. The middle of that range is where most enterprises land after a serious renegotiation cycle. The lever order is commit, then sample-and-retention, then tier. Run them sequentially against residuals.

Try the free calculator — 15 seconds, no signup. Usage-priced rows render with the badge and a $0 utilization compression number, deliberately. The renewal date and the renegotiation playbook are where the real savings sit, and both surface to the right of the row.