Skip to main content
Calcimator

SIEM Sizing Calculator

Size your SIEM deployment: calculate EPS capacity, storage, infrastructure nodes, and license costs by pricing model (Splunk, QRadar, Sentinel).

Inputs

Results

Total EPS

500

Annual license ($)

$47,073.00

≈ 4 years of state college

Daily ingestion (GB)26.2
Indexed storage (TB)3.45
Server nodes3
CPU cores28
RAM (GB)112
Monthly total ($)$5,491.00
Cost per EPS ($/yr)$131.79
How to Use This Calculator
  1. Enter log sources and average EPS per source.
  2. Set online retention (days) and select pricing model (EPS-based, storage-based, or hybrid).
  3. Review total EPS, daily ingestion (GB), total storage (TB), and total nodes.
  4. Add 30-50% headroom for event spikes during incidents or initial onboarding of new log sources.
  5. Compare EPS-based to storage-based pricing -- high-volume/low-value sources favor storage pricing.

How the result changes with Log sources

Log sourcesTotal EPSAnnual license ($)
5,00125,005$2,354,109.00
17,50187,505$8,238,205.00
32,500162,500$15,298,650.00
45,000225,000$21,182,746.00

What each input means

Log sources
Total log-producing devices and applications (servers, firewalls, endpoints, SaaS apps).
Avg EPS per source
Average events per second per source. Firewalls: 10-50, servers: 1-10, endpoints: 0.5-2, apps: 1-5.
Online retention (days)
Days of searchable online retention. PCI requires 90 days online, 1 year total.
Pricing model (0-2)
0 = Per GB/day (Splunk ~$1,800/GB/day/yr), 1 = Per EPS (QRadar ~$20k/1000 EPS/yr), 2 = Per GB ingested (Sentinel ~$2.46/GB).

What each result means

Total EPS
Total events per second the SIEM must handle.
Daily ingestion (GB)
Raw data ingested per day before SIEM indexing.
Indexed storage (TB)
Total indexed storage needed for the retention period (1.5x raw for indexes).
Server nodes
Recommended SIEM cluster nodes (indexers + search heads + management).
CPU cores
Total CPU cores across all SIEM nodes.
RAM (GB)
Total RAM across all SIEM nodes.
Annual license ($)
Estimated annual SIEM software license cost based on selected pricing model.
Monthly total ($)
Monthly total including license and infrastructure.
Cost per EPS ($/yr)
Annual total cost divided by total EPS — useful for comparing SIEM platforms.

How this is calculated

Worked example, using the default values

  1. Identify Input Parameters
    4 parameters
    Log sources = 100, Avg EPS per source = 5, Online retention (days) = 90, Pricing model (0-2) = 0 = 4 input(s) provided
  2. Calculate Total EPS
    Total EPS = logSources * avgEPSPerSource
    500 = 500
  3. Calculate Annual license
    Annual license
    47073 = $47,073
  4. Calculate Daily ingestion
    Daily ingestion = rawBytesPerDay / (1024 * 1024 * 1024)
    26.2 = 26.2
  5. Calculate Indexed storage
    Indexed storage = totalIndexedStorageGB / 1024
    3.45 = 3.45

Engine last updated .

Related Calculators

The questions that sit next to this one — chosen by subject, including calculators filed under a different category.

Investing & Retirement

Earnings Per Share (EPS) Calculator

Company net income divided by shares outstanding.

Security Tools

Log Retention Calculator

Calculate security log storage requirements from log sources, event rates, retention policy, and tiered storage costs. Supports PCI DSS, HIPAA, and SOX compliance planning.

Security Tools

Encryption Strength Calculator

Estimate brute-force time from key length and attacker computing power. Covers symmetric (AES) and asymmetric (RSA) algorithms with quantum threat modeling.

Security Tools

Certificate Expiration Tracker Calculator

Plan SSL/TLS certificate lifecycle management: renewal workload, annual costs, risk scoring, and alert thresholds based on your certificate portfolio.

More in Technology & Computing.