Evtx file contain only parametrized event data (essentially the same information contained in “details” tab of windows event viewer). Splunk input creates a full events text by using event template (which contains the text of the event with parameters) and this parametrized data.
On Windows Event template is the same for all events with the same id, thus windows avoids coping the same information into evtx file. On the other hand Splunk however expand the event to its full form before sending it to Splunk and that cause the Splunk licensing volume to be higher than actual size.
Now Splunk is working to address such concerns by adding new capability in upcoming release 6.2 where it's expected to have XML mode for the windows events which will only forward certain fields of parametrized data into Splunk. If this option is used the size of the log in Splunk will be no more or even less than windows event log size.
