...or do as above and download the free license if you are looking for a lab / trial which doesn't carry as many features as the trial e.g. no multi-user logins and as long as your indexed volumes do not exceed 500meg per day...then upgrade as you experience your input data volumes for indexing. Splunk tends to compress data circa 50% as a guide. The free license doesn't time out if you get busy and don't get the chance to fully evaluate it. I have yet to see a good algorithm for calculating what a company needs commercially so took on x amount and then will upscale as needed. Assuming this not just for a lab situ, we have 64 Windows servers in 1 monitoring Data Centre that consume 295 meg per day indexing. Another of mixed Linux and Windows is averaging 860 meg. Windows is more 'chatty'. Note that license exceeded levels are well documented here and per the doco.....you may experience an initial hike as your syslog or forwarders send a backlog on day 1 but all is forgiven usually as long as you do not exceed 3 in the month. Splunk are great - they understand business cycles. Talk to your point of contact - Eqalis in the UK are brilliant - they will help in your deployment. Getting it right to start with will save you a lot of heart-ache.
Best wishes - have fun 😉
