@adonio's suggestion is the right one. I'm going to add some hopefully-mature political advice.
For certain uses, Splunk is awesome sauce squared, so once you have a working system, different departments will be clamoring to add their data and it will tend to expand to fill all space, time, and money available, like the blob in that old Steve McQueen movie. That's neither good nor bad, it's just a fact of life for systems that create value.
But, if you've created the cost estimate, and the above scenario plays out, both you and the organization need to be able to tease the expense data into a form where your original estimated costs are distinguishable from any later expansions of function.
So, if your use case for SIEM using Splunk gets approved, just make sure your initial design for stand-up actions and change processes includes some provision for additional users justifying and allocating the marginal costs for any additional data feeds that will inevitably accrue over time, along with some level of periodic review to determine whether each existing feed is still cost-justified.
