The observability war just got hotter. AI workloads are flooding enterprise infrastructure, and every CIO needs telemetry to keep agents from running blind.
Datadog (DDOG) just printed a blockbuster Q1 2026 quarter. Splunk, now inside Cisco (CSCO), is being rebuilt as the centerpiece of a unified networking and security stack. Which one should US retail investors actually own?
Why Observability Spending Is Accelerating Post-AI
Generative AI broke traditional monitoring. LLM calls span dozens of microservices, vector databases, and third-party APIs. A single hallucination can cost an enterprise real money.
That has pushed observability from a back-office cost line to a board-level priority. According to Splunk's enterprise leadership team, the convergence of networking, security, and observability is creating a tool consolidation cycle.
For investors, that means a wider total addressable market and stickier customers. Winners take share while laggards get re-rated lower.
Datadog: Net Retention 110%+, Pure-Play Leader
Datadog is the cleanest way to own this trend. Q1 2026 revenue hit $1.006 billion, up 32% year over year. Annual recurring revenue crossed $4 billion for the first time.
According to the Q1 2026 earnings transcript, trailing twelve-month net revenue retention is back in the low 120s. New logo bookings more than doubled year over year.
The customer book also keeps expanding. Datadog now has roughly 33,200 customers, with 4,550 of them spending $100,000 or more annually. That cohort drives about 90% of ARR.
The AI angle is real, not narrative. Our DDOG Q1 2026 earnings preview flagged LLM Observability as the swing variable, and management confirmed it is now contributing meaningfully to billings.
The catch is valuation. DDOG trades around $186 with a forward PE near 86. The growth justifies a premium, but there is no margin of safety if net retention slips again.
Splunk Under Cisco: Integration and Enterprise Push
Cisco bought Splunk for $28 billion in 2024. Two years in, the integration is moving from slide decks to shipped product.
The strategy is bundling. Splunk's data fabric is being wired into Cisco ThousandEyes, AppDynamics, and the new Nexus One switches. NetOps and SecOps teams get a single telemetry pipeline across the entire Cisco footprint.
For Cisco shareholders, this is the bull case. CSCO trades near $96 with a forward PE around 18, well below DDOG. The thesis: Splunk turns hardware customers into recurring software revenue.
The risk is execution. If Splunk loses ground to Datadog on AI workload observability, the bundle premium fades fast. Watch the next two earnings calls for Splunk attach rates inside Cisco's enterprise deals.
Smaller Names: Dynatrace, Elastic, Grafana Labs Pre-IPO
Below the two giants sit credible niche operators. Each plays a different angle of the observability stack.
Dynatrace (DT) trades near $37 with a forward PE around 21. It targets large regulated enterprises with an AI-first observability platform. Fiscal 2026 revenue guidance sits between $2.005 billion and $2.010 billion, with expected EPS growth near 23%.
Elastic (ESTC) trades around $49 with a forward PE near 17. Elastic is the search and logging specialist, and its open-core model wins developer mindshare even when budgets tighten.
Grafana Labs is the pre-IPO wildcard. The company raised at a $9 billion valuation in early 2026 and surpassed $400 million in ARR last fall. Retail investors cannot buy it yet, but a 2027 IPO would reset valuation benchmarks across the group.
| Ticker | Price | Forward PE | Growth Profile |
|---|---|---|---|
| DDOG | $186 | ~86x | 32% revenue growth, NRR ~120% |
| CSCO | $96 | ~18x | Low single digits, dividend payer |
| DT | $37 | ~21x | ~12% revenue, ~23% EPS growth |
| ESTC | $49 | ~17x | Mid-teens revenue growth |
Picking a Winner: Multiple, Growth, and Customer Cohorts
The right pick depends on which lever you trust most. Use three filters: multiple, growth durability, and customer cohort quality.
For pure growth exposure, DDOG is the cleanest single name. The premium multiple is the cost of admission to a 30%-plus grower with 120% net retention.
For balance-sheet investors, CSCO is the safer entry. You get a dividend, an enterprise moat, and optionality on Splunk integration paying off over three to five years.
For value-tilted growth, DT and ESTC both screen well. Mid-teens revenue growth at a teens-to-low-twenties multiple is rare in software right now.
A pragmatic portfolio approach is a small basket. Overweight the leader (DDOG), pair with the safer compounder (CSCO), and add a value name (DT or ESTC) to lower the blended multiple. See our 5 SaaS stocks growth compounding framework for sizing guidance.
Conclusion
Observability is no longer a niche. AI workloads make it foundational, and the spending cycle should run for several more years.
Review your SaaS allocation today. If you do not own any observability exposure, start with DDOG for growth or CSCO for stability. If you already hold one, consider adding a smaller name to diversify.
Open a Gotrade account and start trading US observability stocks from $1 per trade, fractional shares included.
FAQ
Q: Is Datadog overvalued at 86x forward earnings?
A: It is priced for perfection. The valuation only works if net retention stays above 115% and AI workload attach keeps accelerating.
Q: Why buy Cisco instead of Datadog?
A: Cisco offers a dividend, lower multiple, and Splunk optionality. It is the conservative way to own the observability theme.
Q: Can I buy Grafana Labs stock today?
A: No. Grafana Labs is still private. Retail investors will have to wait for an IPO, which has not been announced.
Q: Is Splunk still a separate stock?
A: No. Cisco completed the acquisition in 2024. Splunk now trades as part of CSCO.
Q: Which name has the best risk-reward today?
A: Dynatrace and Elastic screen most attractively on valuation. Both grow faster than Cisco at multiples well below Datadog.
