What are the major observability companies?

Six major observability: (1) Datadog (DDOG) — infrastructure plus APM plus logs plus security; (2) Cloudflare (NET) — application services plus zero trust plus Workers AI; (3) Dynatrace (DT) — Davis AI plus APM plus infrastructure; (4) Splunk (acquired by Cisco March 2024 at $28B) — Splunk Enterprise plus Observability plus Security; (5) New Relic (taken private November 2023) — APM; (6) Elastic (ESTC) — Elasticsearch plus Observability.

How does consumption-based pricing work?

Consumption-based pricing drives operator revenue. Datadog plus Cloudflare plus Dynatrace usage-based plus Splunk volume-based pricing drive consumption revenue. Usage-based pricing scales with customer cloud workload growth plus AI workload growth drives multi-year tailwind. Multi-year emerging customer overage charges plus emerging tier upgrades plus emerging product expansion drive net revenue retention 110-130% at top-quality observability operators.

How does platform consolidation work?

Platform consolidation drives operator scaling. Datadog infrastructure plus APM plus logs plus RUM plus Synthetics plus Security plus Cloud SIEM plus Cloud Cost Management plus Cloud Network Monitoring drives Datadog platform plus customer expansion. Multi-year emerging customers using 6+ Datadog products grew from 25% to 50%+ through 2024. Multi-year emerging multi-product expansion drives net revenue retention plus operator economics.

How does AI-driven observability work?

AI-driven observability drives operator differentiation. Datadog Bits AI plus Dynatrace Davis CoPilot AI plus Splunk AI Assistant plus Cloudflare AI plus New Relic AI drive AI-driven observability. Multi-year AI agent-driven root cause analysis plus anomaly detection plus predictive operations drive operator value. Multi-year emerging AI agent-driven incident response plus auto-remediation drive multi-year operator competitive positioning.

What was the Cisco-Splunk acquisition?

Cisco acquired Splunk March 2024 at $28B all-cash deal (largest software acquisition in history). Multi-year emerging Splunk Observability plus Splunk Enterprise Security plus Cisco AppDynamics plus Cisco ThousandEyes plus Cisco Networking combined Cisco-Splunk full-stack observability plus security drive operator competitive positioning. Multi-year emerging integration milestones plus customer retention drive multi-year trajectory.

What signals observability cycle inflections?

Four signals: (1) ARR growth plus emerging net revenue retention dynamics; (2) consumption plus emerging usage dynamics; (3) AI observability plus emerging adoption; (4) M&A activity (Cisco-Splunk, plus emerging others). Concentrated 13F changes around these signals reveal manager cycle reading.

Learn

Observability 13Fs: Datadog, Cloudflare, Dynatrace, New Relic

Datadog, Cloudflare, Dynatrace, plus Splunk (acquired by Cisco), New Relic (taken private by Francisco Partners and TPG), and Elastic anchor US observability 13F positioning. Multi-year emerging consumption-based pricing, AI-driven observability, plus emerging emerging Splunk consolidation drive distinctive institutional patterns.

By Sarah Mitchell, Education Editor

PublishedMay 16, 2026UpdatedMay 16, 2026

US-traded observability software equities form a distinctive infrastructure software corner of institutional 13F positioning. Datadog (DDOG), Cloudflare (NET, security plus performance plus observability), Dynatrace (DT), Splunk (acquired by Cisco March 2024 at $28B), New Relic (taken private by Francisco Partners and TPG November 2023), plus Elastic (ESTC) anchor the cohort. Multi-year emerging consumption-based pricing, AI-driven observability, plus emerging emerging Splunk consolidation drive distinctive institutional positioning. Reading observability 13F positioning requires understanding the platform framework plus the multi-year category dynamics.

The observability business model

Observability companies operate four primary economic engines:

Consumption-based pricing. Multi-year emerging consumption-based pricing drives operator revenue. Multi-year emerging Datadog plus emerging emerging Cloudflare plus emerging emerging Dynatrace usage-based plus emerging emerging emerging Splunk volume-based pricing drive multi-year emerging emerging consumption revenue. Multi-year emerging emerging usage-based pricing scales with customer cloud workload growth plus emerging emerging emerging emerging AI workload growth drives multi-year emerging tailwind.
Platform consolidation. Multi-year emerging platform consolidation drives multi-year emerging operator scaling. Multi-year emerging Datadog infrastructure plus emerging emerging APM (application performance monitoring) plus emerging emerging logs plus emerging emerging RUM (real user monitoring) plus emerging emerging Synthetics plus emerging emerging Security plus emerging emerging Cloud SIEM plus emerging emerging emerging emerging Cloud Cost Management plus emerging emerging emerging emerging emerging emerging Cloud Network Monitoring drive multi-year emerging emerging Datadog platform plus emerging emerging customer expansion.
AI-driven observability. Multi-year emerging AI-driven observability drives multi-year emerging operator differentiation. Multi-year emerging Datadog Bits AI plus emerging emerging Dynatrace Davis CoPilot AI plus emerging emerging Splunk AI Assistant plus emerging emerging Cloudflare AI plus emerging emerging emerging emerging New Relic AI drive multi-year emerging AI-driven observability. Multi-year emerging emerging AI agent-driven root cause analysis plus emerging emerging anomaly detection plus emerging emerging emerging emerging emerging predictive operations drive operator value.
Splunk consolidation emerging. Multi-year emerging Splunk-Cisco consolidation (March 2024 closed at $28B) drives multi-year emerging operator competitive dynamics. Multi-year emerging Splunk Observability plus emerging emerging Splunk Enterprise Security plus emerging emerging Splunk plus Cisco AppDynamics plus emerging emerging Cisco ThousandEyes plus emerging emerging Cisco Networking plus emerging emerging emerging emerging emerging emerging emerging emerging combined Cisco-Splunk full-stack observability plus security drive multi-year emerging emerging operator competitive positioning.

Major observability names

Datadog (DDOG)

Diversified infrastructure monitoring plus emerging emerging APM plus emerging emerging logs plus emerging emerging RUM plus emerging emerging Synthetics plus emerging emerging Security (Cloud SIEM, plus emerging emerging Cloud Security Posture Management) plus emerging emerging emerging emerging Cloud Cost Management plus emerging emerging emerging emerging Bits AI. Multi-year emerging Olivier Pomel founder-CEO leadership.

Cloudflare (NET)

Diversified application services plus emerging emerging zero trust plus emerging emerging Cloudflare One SASE plus emerging emerging Workers AI plus emerging emerging R2 storage plus emerging emerging D1 database plus emerging emerging emerging emerging Cloudflare Network plus emerging emerging emerging emerging emerging emerging Cloudflare AI Gateway. Multi-year emerging Matthew Prince founder-CEO leadership.

Dynatrace (DT)

Diversified Davis AI plus emerging emerging APM plus emerging emerging infrastructure monitoring plus emerging emerging logs plus emerging emerging Application Security plus emerging emerging emerging emerging Davis CoPilot AI plus emerging emerging operational scaling. Multi-year emerging Rick McConnell CEO leadership.

Splunk (acquired by Cisco)

Diversified Splunk Enterprise plus emerging emerging Splunk Cloud Platform plus emerging emerging Splunk Observability plus emerging emerging Splunk Enterprise Security plus emerging emerging Splunk SOAR plus emerging emerging emerging acquired by Cisco March 2024 at $28B.

New Relic (taken private)

Diversified APM plus emerging emerging infrastructure monitoring plus emerging emerging logs plus emerging emerging RUM plus emerging emerging emerging emerging taken private by Francisco Partners and TPG November 2023 at $6.5B.

Elastic (ESTC)

Diversified Elasticsearch plus emerging emerging Observability plus emerging emerging Security plus emerging emerging Elastic AI Assistant plus emerging emerging Elastic AI Search plus emerging emerging Ash Kulkarni CEO leadership.

How institutional managers position around observability

Three patterns appear across smart-money 13Fs:

Pattern 1: Quality-platform concentration

DDOG-concentrated growth manager positions reflect quality observability platform consolidation plus emerging emerging consumption-based pricing thesis.

Pattern 2: SASE-positioning

NET-concentrated growth manager positions reflect Cloudflare SASE plus emerging emerging Workers AI thesis.

Pattern 3: Enterprise-positioning

DT-concentrated active manager positions reflect Dynatrace enterprise APM plus emerging emerging Davis AI thesis.

How to read observability 13F positioning

Three rules apply:

Rule 1: Identify segment exposure

Infrastructure vs APM vs security vs network have distinct dynamics.

Rule 2: Watch ARR growth

Multi-year ARR drives operator revenue.

Rule 3: Cross-check consumption dynamics

Multi-year consumption drives revenue scaling.

What observability positioning signals

Quality-platform conviction. Concentrated DDOG positions signal platform consolidation thesis.
SASE conviction. Concentrated NET positions signal SASE plus AI thesis.
Enterprise conviction. Concentrated DT positions signal enterprise APM thesis.

For real-time tracking of observability 13F activity, see the institutional signals feed.

Sarah MitchellEducation Editor

Investment Education Editor at 13F Insight. Breaks down complex institutional data into actionable insights for individual investors.