Obviously, you would need some kind of data source that describes the flow of traffic through the Internet connection. For most folks, this would mean getting data out of the edge router.
One data source is SNMP counters. You can script up snmpget to log data about ifInOctets and ifOutOctets on the router, and then Splunk that. This will tell you if there is a bandwidth issue, but not necessarily what is causing it.
Another data source is Netflow. There is an app for that which enables Splunk to load/process Netflow data. However, not all routers have the ability to export Netflow data.
Your mileage may vary in using either of these to resolve your client's issue. This isn't an incredibly straightforward problem to resolve either with Splunk or without.
