Splunk is great because they managed to anchor it to security as a SIEM and have an inscrutable billing model.

Which potential security threat do you want to eliminate to reduce the splunk bill?