Hi Community,
I am trying to understand how ServiceNow Event Management should be sized and used when very large event volumes are involved.
I have already verified that raw events are stored in em_event, alerts in em_alert, and that em_event uses table rotation. In my test instance, the rotation is configured for 1 day with 7 rotations.
My main questions are:
Is there any documented maximum storage/capacity limit for Event Management, such as a GB/TB limit, or is this based on customer-specific database/storage entitlement?
With a 1-day duration and 7 rotations, is it correct to expect roughly 7 days of raw event retention before older rotation data is cleaned/reused?
If an organization needs to retain millions of events for months or years, is the recommended approach to archive them in another ServiceNow table or export them to an external SIEM/data warehouse/data lake?
In short: If ServiceNow receives millions of events, how much data can realistically be retained, for how long, and what is the recommended architecture for longer-term retention?
Any official ServiceNow documentation, sizing guidance, entitlement information, or real-world implementation experience would be greatly appreciated.
Thank you.
