When running a Splunk instance you have the license cost (which might be zero if you're using a trial/free license) and the infrastructure cost (the cost of hardware or cloud vm or container in which you spin up a Splunk instance, in cloud case maybe the cost of network traffic, the cost of someone to maintain it and so on). So on-prem vs. cloud vm covers the infrastructure costs. You still need to handle the license part according to your needs - either buy a properly sized license or use the free one (which has limitations) after the trial period ends. If you choose Splunk Cloud service however, you pay for the service subscription which covers both license and Splunk infrastructure costs. Be aware though that you still might need some self-managed components like forwarders or deployment server (for those you should get a so-called zero-bytes license for free but that's a completely different story) ... View more