You've accidentally described 100% of my experience with Splunk at every org I've worked at: it's so expensive no one is given access to it. It's hard to get logs into it (because of expense). And so you're experience of it is the annointed "splunk team" want something, but you never see how they're using it or really the results at all except when they have an edict they want to hand down because "Splunk says it".