At what scale is your on premise Splunk? As a member of a team maintaining very large on-prem Splunk service I haven't found maintaining Splunk to be an easy undertaking.
1 server install of Splunk Enterprise. Less than 150mb a day ingest. We installed it over a year ago and haven’t touched it since, aside from updates.