I like data model accelerations for doing generalized reporting or searching over a large volume of data.
We get a lot of folks on the Splunk Community Slack asking about putting load balancers or proxies between Splunk forwarders (universal or heavy, it doesn’t matter) and indexers.
This is a TIL post. Thanks to Matt, Duane, and Dave H for this.
Some friends and I have been kicking around the same thought.
Yeah, yeah, yeah. I’m working on it.