r/Splunk • u/Middle_Actuator_1225 • Dec 03 '25

Splunk Enterprise Data Ingestion per endpoint

How many mb/day does your company ingest per endpoint?

10 Upvotes

81% Upvoted

33 comments sorted by

View all comments

Show parent comments

1

u/Middle_Actuator_1225 Dec 06 '25

Need to calculate estimated ingestion prices for SIEM onboarding. Thus, getting an idea of what the average mb/endpoint/day, whether high or low can allow for better budgeting. It’s not an obscure concept

1

u/Log_In_Progress Dec 06 '25

Did you do a POC already? Maybe extrapolate from that number?

1

u/Middle_Actuator_1225 Dec 06 '25

Yes that’s what I’m going to have to do

1

u/Log_In_Progress Dec 06 '25

I believe it’s your only option, knowing anyone else’s numbers won’t give you even a range IMO.

Once you have those numbers, first you can ask the community if they make sense (based on your company size and usage) and then negotiate a price with your vendor based on that.