SIEM EPS Calculator
Convert events per day into average, peak and licensable EPS, with headroom and a twelve-month growth projection.
About SIEM EPS Calculator
Dividing daily events by 86,400 gives the flat average, which is the number nobody should size on: log volume tracks human and business activity, so the busiest hour typically carries 2–3× the daily mean. Multiplying by the peak factor gives the rate the pipeline must actually sustain, and adding headroom gives the licensed figure. SIEM licences and indexer counts are sold against EPS or GB/day, and a platform sized on the daily average will drop events or queue them for hours exactly when an incident is unfolding.
Formulas
SIEM EPS
Average EPS = events per day ÷ 86,400. Peak EPS = average EPS × peak factor. Licensed EPS = peak EPS × (1 + headroom).
- 86,400
- Seconds in a day
- peakFactor
- Peak-to-average ratio, typically 2–3× in enterprise environments
- headroom
- Spare capacity bought for growth and bursts
Twelve-month projection
Projected peak EPS = peak EPS × (1 + annual growth) × (1 + headroom).
- growth
- Annual event-volume growth rate
- headroom
- Licensing headroom fraction
Worked example
With the default values below, SIEM EPS Calculator returns Average EPS of 5,787. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Events per day (all sources)accepts 0–1,000,000,000,000 events/day
- 500,000,000 events/day
- Peak-to-average factorone of Flat 24×7 load — 1.5×, Steady enterprise — 2×, Typical business-hours peak — 2.5×, Spiky, incident-driven — 3×, Very bursty, DDoS-exposed — 4×
- Typical business-hours peak — 2.5×
- Licensing headroomaccepts 0–200 %
- 25 %
- Annual event-volume growthaccepts 0–300 %/year
- 30 %/year
- Log sources in scopeaccepts 1–5,000,000 sources
- 4,500 sources
Results
- Average EPS
- 5,787 EPS
- Peak EPS
- 14,468 EPS
- EPS to LicensePeak plus headroom — the figure to put in the contract.
- 18,084 EPS
- Projected Peak EPS in 12 Months
- 23,510 EPS
- Average EPS per Source
- 1.286 EPS
- Deployment Tier
- Tier 2 — clustered deployment, 3+ indexers
Step by step
- 1Values used
- 2SIEM EPS
- 3Twelve-month projection
- 4Average EPS= 5,787 EPS
- 5Peak EPS= 14,468 EPS
- 6EPS to License= 18,084 EPS
- 7Projected Peak EPS in 12 Months= 23,510 EPS
- 8Average EPS per Source= 1.286 EPS
- 9Deployment Tier= Tier 2 — clustered deployment, 3+ indexers
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or fees or charges into account.
- Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is SIEM EPS calculated?
Average EPS = events per day ÷ 86,400. Peak EPS = average EPS × peak factor. Licensed EPS = peak EPS × (1 + headroom). Dividing daily events by 86,400 gives the flat average, which is the number nobody should size on: log volume tracks human and business activity, so the busiest hour typically carries 2–3× the daily mean. Multiplying by the peak factor gives the rate the pipeline must actually sustain, and adding headroom gives the licensed figure.
Why does SIEM EPS matter?
SIEM licences and indexer counts are sold against EPS or GB/day, and a platform sized on the daily average will drop events or queue them for hours exactly when an incident is unfolding.
What values do I need to enter?
This calculator takes 5 inputs: Events per day (all sources), Peak-to-average factor, Licensing headroom, Annual event-volume growth, Log sources in scope. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should I license on peak or average EPS?
License on peak plus headroom. Most vendors meter a rolling daily or monthly volume rather than instantaneous EPS, so average volume drives the bill — but the hardware, ingest pipeline and queue depth must survive peak, and an under-sized ingest tier turns a busy morning into a detection gap.
My EPS estimate keeps growing. Is that normal?
Yes. Cloud audit trails, EDR telemetry and Kubernetes logging routinely add 20–40% a year without any new business activity. Re-measure quarterly and treat any single estimate as valid for one budget cycle only.