Querymason vs Splunk Calculator

Querymason is the SPL query builder for Splunk professionals who need to work fast. Whether you're in the middle of an incident response, running threat hunts, or just tired of rewriting the same queries from scratch — Querymason puts every search pattern one tap away. BUILD QUERIES INSTANTLY Choose a data source, select a query type, fill in your parameters, and get a complete, production-ready SPL query — syntax-highlighted and ready to paste into Splunk. 20+ DATA SOURCE PROFILES • Network: Router and switch syslog, network access control, next-generation firewalls, SolarWinds, Generic Firewall • Server: Linux Syslog, Windows WEC, Windows Sysmon, CrowdStrike • Data Center: VMware ESXi, VMware vCenter, NetApp, Pure Storage • Applications: Apache HTTP, Microsoft IIS, Nginx, Okta, Microsoft 365 QUERY LIBRARY 40 pre-built, production-tested SPL templates covering the most common SOC and IT operations use cases. Browse, filter, and copy in one tap. The free SOC Starter pack adds 12 more, ready to install from Packs. SHARE WITH YOUR TEAM Export your custom templates to share with teammates and import theirs. Templates you already have are skipped. QUERY HISTORY & PRESETS Never rewrite the same query twice. Querymason keeps your last 75 searches and lets you save unlimited named presets for one-tap recall. SPL ADVISOR A built-in advisor reviews your query and suggests performance improvements and command explanations. It works offline, and nothing leaves your device. PRO — ONE-TIME PURCHASE Everything above is free. One optional in-app purchase unlocks Pro: • Learning mode: an Explain switch on the query result walks through each pipe of your query in plain language, with short practice questions to test yourself • Sector packs built into the app: Threat Hunting (25 queries), Cloud Audit (18) and IT Ops Health (15) • Future Pro features at no extra cost Pay once. No subscription, no account. Restore Purchase is in the Pro screen. DESIGNED FOR THE FIELD A distraction-free dark interface built for long shifts. Syntax highlighting, copy-to-clipboard, and a clean 4-step wizard mean fewer mistakes under pressure. PRIVACY FIRST Querymason works entirely on-device. No telemetry, no accounts, no network calls. Purchases are handled entirely by Apple. Your queries never leave your device. Querymason is an independent product. It is not affiliated with, endorsed by or sponsored by Splunk Inc. Splunk® is a registered trademark of Splunk Inc.

Splunk SIEM Storage Calculator — designed for security architects, SOC engineers, and Splunk administrators sizing indexer clusters in the field. Compute hot/warm, cold, and frozen storage from any combination of EPS, average event size, retention, and replication policy. Built for real Splunk Enterprise sizing, including multi-site clusters with explicit RF and SF totals. INPUTS • Events per second or direct GB/day • Average event size (bytes) • Raw compression ratio (default 0.15) • TSIDX overhead (default 0.45 — reflects high-cardinality SIEM data) • Retention per tier in days, months, or years • Indexer count, replication factor, search factor • Cluster site count for multi-site deployments OUTPUTS • Daily ingest in GB • Cluster total storage • Per-tier breakdown (hot/warm, cold, frozen) • Per-site and per-indexer storage requirements iOS 26 NATIVE Liquid Glass interface. Universal iPhone and iPad. Works offline. PRIVACY All calculations happen on device. No accounts, no analytics, no network requests. Your inputs persist locally on your phone, never leave it. This is an estimation tool. Real-world usage varies with bucket policies, search load, and data model acceleration. Not affiliated with Splunk Inc.