Splunk already costs you an arm and a leg. Adding a "best-in-class" SOAR on top for 200 users is a great way to lose the other leg.
The real question is why you think you need a separate SOAR. Splunk's built-in automation (Splunk SOAR, formerly Phantom) is the obvious, integrated choice. But it's also pricey and can be overkill. Most shops that size just need to automate a handful of repetitive tasks, not run a full cyber command center.
Look at your actual processes first. Are you drowning in manual ticket creation? Need to automate a few enrichment steps? You could probably hack together something robust with Splunk's own alert actions, webhooks, and a lightweight orchestrator like n8n or even a few well-designed scripts. The ROI on a dedicated SOAR platform for a team your size is... dubious.
Everyone's pushing their shiny SOAR solution, but you're just buying a new problem: more integration headaches, another console, another subscription. Start with what you can automate for free inside your existing stack.
Just my two cents.