Rate limiting for API or HTTP Event Collector?

[Jeremiah]

Has anyone tried implementing rate-limiting on either the Splunk API, UI or the HTTP Event Collector? I'm thinking either on a per-IP, user, or token basis?

I know Splunk has built-in quotas for executing searches, but I'm thinking about the other ways you can overload a server, for example through excessive REST queries, programmatically refreshing the browser, or pushing excessive HEC events.

Maybe via load balancer, or by using an nginx frontend?

[gblock_splunk]

Hi Jeremiah

We don't have anything built in to rate limit access. Using something like nginx would be a good option.