Work out siem storage sizing instantly with clear inputs, formula shown and shareable results.
SIEM storage is events per second times average event size times retention seconds, plus index overhead. Event size varies widely — a Windows security event with full XML can exceed a kilobyte while a syslog line is a couple of hundred bytes — so measuring your own average is essential. Index overhead depends on how many fields are extracted and whether raw events are also kept.
SIEM storage
daily = EPS x 86400 x bytes per event; total = daily x retention days x (1 + index overhead)
Often yes. Many platforms compress raw events by 5 to 10 times while the index grows, so the net figure can land near the raw volume — but measure rather than assume.
Drop high-volume low-value sources such as successful DNS lookups to internal resolvers, aggregate firewall accepts, and route verbose debug logs to cheap object storage instead of the SIEM.