Splunk Calculator

Splunk SIEM Storage Calculator — designed for security architects, SOC engineers, and Splunk administrators sizing indexer clusters in the field.

Compute hot/warm, cold, and frozen storage from any combination of EPS, average event size, retention, and replication policy. Built for real Splunk Enterprise sizing, including multi-site clusters with explicit RF and SF totals.

INPUTS
• Events per second or direct GB/day
• Average event size (bytes)
• Raw compression ratio (default 0.15)
• TSIDX overhead (default 0.45 — reflects high-cardinality SIEM data)
• Retention per tier in days, months, or years
• Indexer count, replication factor, search factor
• Cluster site count for multi-site deployments

OUTPUTS
• Daily ingest in GB
• Cluster total storage
• Per-tier breakdown (hot/warm, cold, frozen)
• Per-site and per-indexer storage requirements

iOS 26 NATIVE
Liquid Glass interface. Universal iPhone and iPad. Works offline.

PRIVACY
All calculations happen on device. No accounts, no analytics, no network requests. Your inputs persist locally on your phone, never leave it.
This is an estimation tool. Real-world usage varies with bucket policies, search load, and data model acceleration. Not affiliated with Splunk Inc.