SIEM Sizing Calculator

Total EPS is simply log sources multiplied by average EPS per source, and that single number drives every downstream calculation -- ingestion volume, storage, infrastructure nodes, and license cost under EPS-based pricing. A mixed environment where firewalls run 10-50 EPS and endpoints sit at 0.5-2 EPS needs a realistic blended average, because overestimating it inflates every cost line, while underestimating it under-sizes your indexer and search node counts.

Raw log data has to be parsed and indexed to become searchable, and that index structure (field extraction, time-series indexes, metadata) adds overhead on top of the original bytes. This calculator models that overhead as a flat 1.5x multiplier applied before multiplying by your retention window, so a 90-day retention on 100 GB/day raw ingestion becomes 13.5 TB of indexed storage, not 9 TB.

Per-GB/day (Splunk-style) is the most common model and scales with your daily ingestion volume regardless of how many log sources produce it. Per-EPS (QRadar-style) instead scales with event rate, which can be cheaper for high-volume-but-small-event sources like NetFlow. Per-GB-ingested (Sentinel-style) is similar to per-GB/day but often has a lower headline rate -- run all three with your own numbers since the cheapest model depends entirely on your event size and source mix.

Indexers do the heavy lifting of writing and storing indexed data, so they're sized at one node per 100 GB/day of raw ingestion with 16 cores and 64 GB RAM each. Search heads handle query load rather than ingestion, so they're sized more loosely at one per 200 GB/day with half the cores. A fixed management node is added on top of both, which is why total node count is never just ingestion divided by one ratio.