I'd add in looking at #C811PUZU4 while you're doing this research a) because I work there and b) because we have multiple deployments where we are paired with Splunk and can share real world examples of how the pairing has benefited our clients.