SIEM EPS Calculator
Convert events per day into average, peak and licensable EPS, with headroom and a twelve-month growth projection.
Inputs
Sizing on the daily average under-provisions the pipeline during the 09:00–17:00 window.
Average EPS
5,787EPS
Peak EPS
14,468EPS
EPS to License
18,084EPS
Peak plus headroom — the figure to put in the contract.
Projected Peak EPS in 12 Months
23,510EPS
Average EPS per Source
1.286EPS
Deployment Tier
Tier 2 — clustered deployment, 3+ indexers
Step by step
Values used
Events per day (all sources) = 500,000,000 events/day; Peak-to-average factor = Typical business-hours peak — 2.5×; Licensing headroom = 25 %; Annual event-volume growth = 30 %/year; Log sources in scope = 4,500 sources
SIEM EPS
Average EPS = events per day ÷ 86,400. Peak EPS = average EPS × peak factor. Licensed EPS = peak EPS × (1 + headroom).
Twelve-month projection
Projected peak EPS = peak EPS × (1 + annual growth) × (1 + headroom).
Average EPS
= 5,787 EPS
Peak EPS
= 14,468 EPS
EPS to License
= 18,084 EPS
Projected Peak EPS in 12 Months
= 23,510 EPS
Average EPS per Source
= 1.286 EPS
Deployment Tier
= Tier 2 — clustered deployment, 3+ indexers
How it works
Dividing daily events by 86,400 gives the flat average, which is the number nobody should size on: log volume tracks human and business activity, so the busiest hour typically carries 2–3× the daily mean. Multiplying by the peak factor gives the rate the pipeline must actually sustain, and adding headroom gives the licensed figure. SIEM licences and indexer counts are sold against EPS or GB/day, and a platform sized on the daily average will drop events or queue them for hours exactly when an incident is unfolding.
Formulas
SIEM EPS
Average EPS = events per day ÷ 86,400. Peak EPS = average EPS × peak factor. Licensed EPS = peak EPS × (1 + headroom).
- 86,400
- Seconds in a day
- peakFactor
- Peak-to-average ratio, typically 2–3× in enterprise environments
- headroom
- Spare capacity bought for growth and bursts
Twelve-month projection
Projected peak EPS = peak EPS × (1 + annual growth) × (1 + headroom).
- growth
- Annual event-volume growth rate
- headroom
- Licensing headroom fraction
Frequently Asked Questions
How is SIEM EPS calculated?
Average EPS = events per day ÷ 86,400. Peak EPS = average EPS × peak factor. Licensed EPS = peak EPS × (1 + headroom). Dividing daily events by 86,400 gives the flat average, which is the number nobody should size on: log volume tracks human and business activity, so the busiest hour typically carries 2–3× the daily mean. Multiplying by the peak factor gives the rate the pipeline must actually sustain, and adding headroom gives the licensed figure.
Why does SIEM EPS matter?
SIEM licences and indexer counts are sold against EPS or GB/day, and a platform sized on the daily average will drop events or queue them for hours exactly when an incident is unfolding.
What values do I need to enter?
This calculator takes 5 inputs: Events per day (all sources), Peak-to-average factor, Licensing headroom, Annual event-volume growth, Log sources in scope. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should I license on peak or average EPS?
License on peak plus headroom. Most vendors meter a rolling daily or monthly volume rather than instantaneous EPS, so average volume drives the bill — but the hardware, ingest pipeline and queue depth must survive peak, and an under-sized ingest tier turns a busy morning into a detection gap.
My EPS estimate keeps growing. Is that normal?
Yes. Cloud audit trails, EDR telemetry and Kubernetes logging routinely add 20–40% a year without any new business activity. Re-measure quarterly and treat any single estimate as valid for one budget cycle only.