EPS to GB conversion for SIEM pricing: 2026 tables and worked examples

SIEM vendors split into two pricing camps based on the underlying cost driver of their architecture. Per-GB-priced SIEMs (Splunk, Microsoft Sentinel, Datadog, Sumo Logic, Devo, CrowdStrike LogScale) meter on data volume because their analytics engines scale with bytes processed. Per-EPS-priced SIEMs (IBM QRadar, Securonix, LogRhythm via MPS) meter on event rate because their correlation engines scale with events per second. Both models are honest reflections of what costs money on the vendor side, but they make cross-shop comparisons require a conversion step.

The conversion is not a constant. EPS measures the rate of events per second; GB measures the volume of bytes ingested. The two correlate loosely but not tightly because event size varies enormously by source. A Windows security event log entry runs 1-2 KB on average; an AWS CloudTrail JSON event runs 5-15 KB; a firewall log entry runs 200-500 bytes; a NetFlow record runs 100-300 bytes. The same data volume in gigabytes produces wildly different event counts depending on which sources dominate the mix.

The practical effect is that customers comparing vendors based on assumed conversion ratios routinely get wrong answers by 30-50 percent in either direction. A network-heavy environment shopping per-EPS QRadar against per-GB Splunk based on a 100 EPS-per-GB conversion (the rough mixed-enterprise average) will materially under-buy QRadar capacity and over-buy Splunk capacity. The reverse profile (cloud-native, JSON-heavy) will produce the inverse error. The conversion discipline matters because the vendor decision frequently turns on it.

Sample your environment for 30-60 days before any vendor sizing conversation. Modern SIEMs (any of the vendors listed in our pricing pages) provide native EPS and GB-per-day metering at the source level, free of charge during evaluation. Many environments already have this data available from an existing log management tool, even if the SIEM purchasing decision is brand-new. Without 30-60 days of source-level data, every vendor sizing conversation is based on assumption rather than measurement, and assumptions in this domain routinely produce wrong vendor decisions.

Calculate the weighted-average EPS-to-GB ratio across your real source mix. The math is straightforward once the sampling exists: for each major source, multiply its observed EPS by its observed GB-per-day, sum the products, divide by total GB-per-day. The resulting ratio applies to your specific environment and replaces the rough mixed-enterprise average that vendor pre-sales materials routinely use.

Apply the ratio in both directions when cross-shopping. Per-EPS vendor quotes get converted to per-GB equivalents using your environment's actual ratio; per-GB vendor quotes get converted to per-EPS equivalents using the inverse. The honest comparison shows where each vendor sits on cost in your specific environment, not in a generic environment that does not exist. Vendors that claim to be cheapest at the headline rate frequently are not cheapest in your specific source mix; vendors that look uncompetitive at the headline rate frequently win once the conversion is applied honestly.

Finally, never accept a vendor's own conversion ratio without sourcing it back to your actual environment data. Splunk pre-sales materials assume per-EPS conversion rates that overstate Splunk's competitive position; QRadar pre-sales materials assume rates that overstate QRadar's. The conflict of interest is real and unavoidable. The honest conversion is the one calculated from your data, not from any vendor's marketing.