ResourcesCost of doing nothing

What does waiting cost over three years?

At 1,000 GB/day on Splunk at a negotiated 40% below list, doing nothing costs $4,524,304 over three years. The written floor keeps $904,861 of it, and the net after every cost you can check is $78,587 to $531,017, before Logmetry services.

Run it on your own numbers →

Doing nothing: $4,524,304
At the floor, before Logmetry services: $4,219,502
Net, before Logmetry services: $78,587 to $531,017

Illustrative, at an assumed negotiated price, replace it with your contract price.

01The worked example

Three years of the same Splunk estate, two ways

Doing nothing on Splunk costs $4,524,304 over three years at 40% below list, and the written floor of 20% less into the SIEM keeps $904,861 of it.

The worked example, year by year, before Logmetry services
	Year 1	Year 2	Year 3	Three years
Daily volume into the SIEM, GB/day	1,000	1,290	1,664
Splunk price per GB/day a year, list less 40%	$1,080	$1,134	$1,191
Doing nothing: the Splunk license	$1,080,000	$1,462,860	$1,981,444	$4,524,304
The hard saving, 20% less into Splunk	$216,000	$292,572	$396,289	$904,861
Pipeline platform at list	$116,800	$150,672	$194,367	$461,839
Full-fidelity copy, object storage	$24,840	$32,044	$41,336	$98,220
Your team’s hours, the build in year 1	$24,000	$8,000	$8,000	$40,000
At the floor, before Logmetry services	$1,029,640	$1,361,004	$1,828,858	$4,219,502
Net, before Logmetry services	$50,360	$101,856	$152,586	$304,802

Net, before Logmetry services

$78,587 to $531,017

$304,802 in the middle, the hard saving a quarter lower or higher at the ends

Services budget the case can carry (NPV zero)

$243,146

Any one-time services quote below it leaves the three-year case positive

Budget for payback within a year

$50,360

The quote that year 1’s saving pays back in full

Break-even volume

116.0 GB/day

Below it, your team’s hours outweigh the saving

Illustrative, at an assumed negotiated price, replace it with your contract price. Sources and dates in section 04.

02Other SIEMs

The same estate on Microsoft Sentinel, Datadog and CrowdStrike

Same 1,000 GB/day, same growth, same renewal rise, each at its own price after discount: three years of doing nothing runs from $3,792,037 on Sentinel to $5,458,698 on CrowdStrike.

Three years of doing nothing on each SIEM, at its price after the assumed discount
	Price per GB/day a year, after discount	Year 1	Three years, doing nothing
Splunk	$1,080	$1,080,000	$4,524,304
Microsoft Sentinel	$905	$905,200	$3,792,037
Datadog Cloud SIEM	$1,117	$1,116,900	$4,678,884
CrowdStrike Falcon Next-Gen SIEM	$1,303	$1,303,050	$5,458,698

Splunk. The low end of the Splunk Enterprise list range, less 40%, the top of the 30 to 40% below list that Vendr reports for buyers at 1,000 GB/day or more. Vendr, Splunk marketplace page, February 2026.
Microsoft Sentinel. The published 1,000 GB/day commitment tier, $2,480 a day in East US. The tier is already Microsoft’s volume discount, about 42% below pay-as-you-go, so no further discount is assumed. Microsoft Sentinel pricing, Azure retail prices, East US.
Datadog Cloud SIEM. Datadog’s published $5 per million analyzed events, billed annually, plus $0.10 per GB ingested, assuming events average 1 KB, less 40%, inside the 30 to 45% Vendr reports for large deployments. Datadog pricing list, Cloud SIEM and Log Management.
CrowdStrike Falcon Next-Gen SIEM. CrowdStrike’s published pay-as-you-go price on AWS Marketplace, $0.00595 per MB of non-Falcon data ingested with 13-month retention included, less 40%. Vendr reports CrowdStrike discounts as common at volume but gives no percentage, so the 40% matches the Splunk and Datadog assumption. Falcon Insight customers also get the first 10 GB a day free. AWS Marketplace, CrowdStrike Falcon Next-Gen SIEM (pay-as-you-go).

Same growth and renewal rise as the worked example for each. Illustrative, at an assumed negotiated price, replace it with your contract price.

03Your numbers

Run the same model on your own estate

Change any input and every figure beside it recomputes, with the same formulas as the worked example.

Start from a platform

Fills the price and discount from section 02. Your contract beats any of them.

Volume into the SIEM today, GB/day

From your license usage report, the daily average.

Growth in that volume a year, percent

An IDC forecast by default. Your own year-on-year usage is better.

List price per GB/day a year, USD

The low end of the Splunk Enterprise list range by default (Vendr, February 2026).

Your discount off that price, percent

The top of the 30 to 40% below Splunk list that Vendr reports at 1,000 GB/day or more. Enter your contract price above and set this to zero.

Price rise at each renewal, percent

Applied from year 2. Your order form is the number that applies.

Reduction into the SIEM, percent

Logmetry’s written floor: At least 20% less into your SIEM, every alert kept, proved on your data.

Three years, before Logmetry services

Doing nothing: $4,524,304
At your reduction: $4,219,502
The hard saving: $904,861

Net, before Logmetry services

$304,802

Range $78,587 to $531,017, the hard saving a quarter lower or higher

Services budget the case can carry (NPV zero): $243,146
Budget for payback within a year: $50,360
Break-even volume: 116.0 GB/day

Illustrative, at an assumed negotiated price, replace it with your contract price. Every output is before Logmetry services.

04The method

Every formula in plain words, every number sourced

The model is short enough to check by hand, and every input carries its source and the date it was read.

The formulas

Volume. Today’s GB/day, grown once by the growth rate for each year after the first. Year 1 uses today’s volume.
Doing nothing. That year’s volume times the price per GB/day a year: list, less your discount, raised by the renewal rise from year 2. Year 1 is the next contract year at today’s price.
The hard saving. The reduction times that year’s volume times that year’s price, from the renewal the lower tier first applies to, year 1 here.
Pipeline platform at list. That year’s volume times 365 days times $0.32 per GB. It charges on everything it receives, not only on what reaches the SIEM.
Full-fidelity copy. That year’s volume times 90 days kept times $0.023 per GB-month times 12 months, uncompressed.
Your team. 160 hours once for the build and 80 hours a year to run it, at $100 an hour.
At the floor. Doing nothing, less the hard saving, plus every cost above. The net is the hard saving less every cost.
The range. The hard saving a quarter lower and a quarter higher, because an early estimate belongs in a range.
Services budget the case can carry. The three-year NPV at a ten percent discount rate, with the build in year 0. A quote at that figure makes the NPV zero.
Budget for payback within a year. Year 1’s saving less its running costs, less the build.
Break-even volume. The daily volume at which the net before Logmetry services is zero.

The sources

Splunk at $1,800 per GB/day a year, less 40%Vendr, Splunk marketplace page, February 2026: Splunk Enterprise list pricing “typically ranges from $1,800 to $2,700 per GB/day annually”, and buyers at 1,000 GB/day or more commonly get per-GB rates 30 to 40% below it. The low end of list and the top of the discount.
A 5% rise at each Splunk renewalOur assumption, below the 9% standard uplift Splunk published for one-year renewals until spring 2026. Your order form is the number that applies.
Growth in volume29% a year, an IDC forecast quoted by Cribl in “The telemetry time bomb”, July 2026. Your own year-on-year license usage is better.
Other SIEMsMicrosoft’s published Sentinel commitment tiers, Datadog’s published Cloud SIEM and log ingestion prices, Vendr’s Datadog discount range, and CrowdStrike’s published Falcon Next-Gen SIEM price on AWS Marketplace, each linked in section 02.
Pipeline platform at list$0.32 per GB received, a pipeline platform’s published list price for its cloud tier, read 28 September 2026.
Object storage$0.023 per GB-month, Amazon S3 Standard, US East (N. Virginia), first 50 TB a month, AWS price list published 26 September 2026.
The reductionThe written floor, the first success criterion of every proof of value. At least 20% less into your SIEM, every alert kept, proved on your data.
Illustrative1,000 GB/day, 90 days kept, your team’s hours and rate, and the discount rate. Replace each with yours.

05What it leaves out

Conservative: what cannot be checked counts as zero

Only hard savings count toward the net. Everything else is listed and priced at zero.

Conservative by design

The reduction is the written floor, not a forecast.
Year 1 uses today’s volume, and savings land at the renewal, not before.
The worked example takes the low end of list and the top of the discount buyers report.
The full-fidelity copy is charged in full from year 1, uncompressed.
Soft benefits are listed and priced at zero.

Soft benefits, priced at zero

Clean data for AI, normalized before anything reads it.
Faster investigations on consistent fields.
Audit retention in your own account, at object storage prices.
PII masked before any model sees an event.
Freedom to change SIEM without collecting everything again.

When the model says no, say so.

Small volumes, a renewal already signed for three years, or a contract price far below the example can each turn the net negative. That is an answer too, and the review gives it plainly rather than stretch the reduction to make a case.

06Questions

Asked about the cost of doing nothing

Why does the Splunk example assume a 40% discount?

Because nobody at 1,000 GB/day pays list. Vendr’s buyer data (February 2026) puts Splunk Enterprise list pricing at $1,800 to $2,700 per GB/day a year, and says buyers committing to 1,000 GB/day or more commonly get 30 to 40% below list. The example takes the low end of list and the top of that discount, $1,080, so it understates rather than inflates. Replace it with your contract price, and the case moves with it.

What about Microsoft Sentinel, Datadog or CrowdStrike?

The model is the same for any SIEM priced on volume, only the price changes. Pick a platform at the top of the inputs and it fills in a price: Sentinel’s published 1,000 GB/day commitment tier, Datadog’s published Cloud SIEM rate at an assumed 1 KB an event less 40%, CrowdStrike’s published AWS Marketplace rate for Falcon Next-Gen SIEM less 40%, or Splunk less 40%. Your own quote beats all of them.

Why is there no Logmetry price in the case?

Because the case should stand on costs anyone can check. It shows the services budget the case can carry instead: $243,146 at the defaults, the one-time quote at which the three-year NPV is zero, and $50,360 for payback within a year. Hold any quote against those, ours included.

What if our volume is small?

Below about 116.0 GB/day at the defaults, your own team’s hours outweigh the hard saving at the written floor, and the model says no. Then the honest answer is not to buy a pipeline to save money, and the review will say so.

See your architecture drawn, with the costs, before you spend anything.

Our lead architects draw your SIEM feed from your diagrams: where the cost sits, what step one would change, and where it would not pay. If it pays, the next step is a two-week proof on your noisiest source.

Book the architecture review Or take the Blueprint as a PDF →

Free. No system access. No obligation. You keep the drawing.

What you get

Your architecture today, drawn
The waste map
Costs before and after, with estimates
Your target architecture
Options for your business problem

What it costsNothing