Is there a way in splunk to identify how much network traffic is being sent from the indexers (not just how much is indexed)? In addition, can I find a rough estimate of traffic from search head to user? I am not sure if Splunk logs this, but I was hoping.
There is a Splunk SOS app (http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk) which provide so many statistical data about splunk instance, and I believe Network volume is one the metrics it reports on. Worth checking out.