They mean doing the processing that Splunk does is expensive so there simply needs to be less data going into the system (via the pre-processing steps I mentioned) above in order to keep costs sane.

With that said Splunk should offer such a pre-processing product (maybe it does?) which would probably increase their moat even though it reduces revenue somewhat in the near term.

Splunk has Edge Processor and Ingest actions to filter, mask and route data.

https://www.splunk.com/en_us/blog/platform/introducing-edge-...

https://www.splunk.com/en_us/blog/conf-splunklive/ingest-act...