It's common to hit numbers like 10MB/s on modern hardware in splunk 5 or 6, though there are many variables and with some data you might have lower numbers without anything being wrong. I have seen scenarios where 20MB/s was achieved. 2MB/s sounds like problem territory.
We don't have "Quality of Service"-like controls to prioritize one large file over all other data, so if the system can't handle the aggregate data, the largest single datasource may lag.
There are many potential bottlenecks in the system, and it's hard to diagnose this without full support contact. Of course you probably dealt with this problem long ago, but I'm answering because the core question about expected throughput is important.
... View more