@coffee might have to come pick your brain afterwards. We're pushing almost a 1TB/day to splunk right now and its... well... Not having the best time