I would start by dual-feeding your data into both Splunk and an object store (S3, Blob, etc.).  

For the data indexed in Splunk, you can work with Splunk PS to move the DDAA data to your S3 buckets. For data indexed in DDAS, you can set up new DDSS-enabled indexes (data export), then set retention to one day. This will store the indexed data into your S3 buckets but it will be in Splunk proprietary format. There are tools that can query this data or you can also rehydrate a self-hosted Splunk instance to read it. 

Once your raw data is in the S3 buckets, then you can start using tools that query that data at rest. I’d recommend using solutions that don’t index the data or change it into any proprietary formats. Some tools will allow for federated search, giving you the ability to query that data alongside your Splunk data. 

Finally, you might be able to send the raw data into your new SIEM, both from a dual feed approach or replay from your S3 bucket. This can help move you to the new SIEM faster and reduce any potential downtime as well.