Log Sampling Savings Calculator

Use this quick ROI view to defend log sampling or filter policies. Combine your daily ingest, per-GB pricing, and proposed sampling rate to show how much spend and hot-retention headroom you reclaim.

Average uncompressed data shipped into your SIEM or log lake each day.
Blended cost per gigabyte including ingestion and retention tiers.
Optional. Defaults to 40%. Enter the fraction of log events you plan to keep.
Optional. Defaults to 30 days of hot storage.

Budgeting aid only—validate sampling plans with your observability and security teams before implementation.

Examples

  • 18 GB/day at $0.62 per GB, 35% sampling, and 45-day retention ⇒ Full-fidelity storage costs $502.20 USD over 45.00 days • Keeping 35.00% of events costs $175.77 USD • Sampling saves $326.43 USD (65.00%) and frees 526.50 GB of hot retention.
  • 42 GB/day at $0.48 per GB with default sampling and retention ⇒ Full-fidelity storage costs $604.80 USD over 30.00 days • Keeping 40.00% of events costs $241.92 USD • Sampling saves $362.88 USD (60.00%) and frees 756.00 GB of hot retention.

FAQ

Does this include cold storage tiers?

No. Duplicate the calculation with a lower cost per GB if you want to model archived tiers separately.

How should I treat compression?

Use post-compression GB if your vendor bills on compressed volume; otherwise enter raw ingest size to match cloud egress bills.

What if sampling impacts detection coverage?

Pair the savings output with your threat-model review so security leadership can balance coverage against the freed budget.

Additional Information

  • Result unit: U.S. dollars, plus the GB of hot retention avoided.
  • Sampling percent represents the data you keep. Enter 100% to compare against a no-sampling scenario.
  • Retention defaults to 30 days, matching common hot-tier SLAs for security log searches.

Related calculators