I like data model accelerations for doing generalized reporting or searching over a large volume of data.

We get a lot of folks on the Splunk Community Slack asking about putting load balancers or proxies between Splunk forwarders (universal or heavy, it doesn’t matter) and indexers.

This is a TIL post. Thanks to Matt, Duane, and Dave H for this.

Some friends and I have been kicking around the same thought.

Yeah, yeah, yeah. I’m working on it.