No. Splunk's data streaming and "fixup" activity in the case of failure is designed to return the cluster to a healthy state as soon as possible. For "live data" streaming (we call this hot buckets), you're sending a copy of the data "slice" (~128kb by default) from the source indexer to as many peers as required to meet the replication factor. When you've got downtime or another event that requires "fixing" a cluster, you can throttle the number of jobs (that is, active simultaneous attempts to copy the data), but not the bandwidth consumed.
Unfortunately, if you're counting bytes on the WAN, you may not be ready for multi-site clustering.
