Skip to content
ENExplore Calculators

SIEM Storage Sizing Calculator

Work out siem storage sizing instantly with clear inputs, formula shown and shareable results.

About SIEM Storage Sizing Calculator

SIEM storage is events per second times average event size times retention seconds, plus index overhead. Event size varies widely — a Windows security event with full XML can exceed a kilobyte while a syslog line is a couple of hundred bytes — so measuring your own average is essential. Index overhead depends on how many fields are extracted and whether raw events are also kept.

Formula

SIEM storage

daily = EPS x 86400 x bytes per event; total = daily x retention days x (1 + index overhead)

Worked example

With the default values below, SIEM Storage Sizing Calculator returns Total SIEM storage required of 42.01 TiB. Change any input above and every figure here is recalculated in your browser.

Inputs used

Average events per secondminimum 0.01 eps
4,000 eps
Average event sizeminimum 1 bytes
550 bytes
Retentionminimum 1 days
180 days
Index overheadaccepts 0–300 %
35 %

Results

Total SIEM storage required
42.01 TiB
Daily ingest volume
177.03 GiB
Raw event storage
31.12 TiB
Index and metadata overhead
10.89 TiB

Step by step

  1. 1Values used
  2. 2SIEM storage
  3. 3Total SIEM storage required= 46,189,440,000,000
  4. 4Daily ingest volume= 190,080,000,000
  5. 5Raw event storage= 34,214,400,000,000
  6. 6Index and metadata overhead= 11,975,040,000,000

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Can compression offset the index overhead?

Often yes. Many platforms compress raw events by 5 to 10 times while the index grows, so the net figure can land near the raw volume — but measure rather than assume.

How can ingest be reduced without losing detection?

Drop high-volume low-value sources such as successful DNS lookups to internal resolvers, aggregate firewall accepts, and route verbose debug logs to cheap object storage instead of the SIEM.

Related Calculators

SIEM Storage Sizing Calculator | Calcrivo