Splunk Query Studio vs Splunk Calculator

Splunk Query Studio is the SPL query builder for Splunk professionals who need to work fast. Whether you're in the middle of an incident response, running threat hunts, or just tired of rewriting the same queries from scratch — Studio puts every search pattern one tap away. BUILD QUERIES INSTANTLY Choose a data source, select a query type, fill in your parameters, and get a complete, production-ready SPL query — syntax-highlighted and ready to paste into Splunk. 20 DATA SOURCE PROFILES • Network: Cisco IOS/NX-OS, Cisco ISE, Cisco Firepower/FTD, Cisco* (wildcard), Palo Alto Networks, SolarWinds, Generic Firewall • Server: Linux Syslog, Windows WEC, Windows Sysmon, CrowdStrike • Data Center: VMware ESXi, VMware vCenter, NetApp, Pure Storage • Applications: Apache HTTP, Microsoft IIS, Nginx, Okta, Microsoft 365 QUERY HISTORY & PRESETS Never rewrite the same query twice. Studio keeps your last 75 searches and lets you save unlimited named presets for one-tap recall. DESIGNED FOR THE FIELD A distraction-free dark interface built for long shifts. Syntax highlighting with zero overlap artifacts. Copy any query to clipboard directly from the app. PRIVACY FIRST Splunk Query Studio works entirely on-device. No telemetry, no accounts, no network calls. Your queries never leave your device.

Splunk SIEM Storage Calculator — designed for security architects, SOC engineers, and Splunk administrators sizing indexer clusters in the field. Compute hot/warm, cold, and frozen storage from any combination of EPS, average event size, retention, and replication policy. Built for real Splunk Enterprise sizing, including multi-site clusters with explicit RF and SF totals. INPUTS • Events per second or direct GB/day • Average event size (bytes) • Raw compression ratio (default 0.15) • TSIDX overhead (default 0.45 — reflects high-cardinality SIEM data) • Retention per tier in days, months, or years • Indexer count, replication factor, search factor • Cluster site count for multi-site deployments OUTPUTS • Daily ingest in GB • Cluster total storage • Per-tier breakdown (hot/warm, cold, frozen) • Per-site and per-indexer storage requirements iOS 26 NATIVE Liquid Glass interface. Universal iPhone and iPad. Works offline. PRIVACY All calculations happen on device. No accounts, no analytics, no network requests. Your inputs persist locally on your phone, never leave it. This is an estimation tool. Real-world usage varies with bucket policies, search load, and data model acceleration. Not affiliated with Splunk Inc.