Making the move from Splunk to Elastic SIEM is a big decision. Firms do not make this move simply because they are bored.