Had the same suspicion when the order to install Splunk everywhere came from above. We already had central logging for years... No reason was given. Just. Do. It.