We're seeing about 50 ms. Normal range? How would we optimize this?
EDIT: Also, how do you measure HEC performance from Splunk's point of view? I don't see anything in metrics that explicitly calls out HEC. Since the end user can adjust source arbitrarily, how do you isolate HEC stats from metrics?