I asked a slightly different question, but I'd love to hear about your experience running Splunk: https://news.ycombinator.com/item?id=34412176