This is a really interesting concept, which does make sense. The aggregates become pretty important in this kind of setup. I'm pretty familiar with Splunk, and

This is a really interesting concept, which does make sense. The aggregates become pretty important in this kind of setup. I'm pretty familiar with Splunk, and most of these concepts align with the capabilities of Splunk, although Splunk is not usually used in these sorts of use-cases. Has anyone here here implemented a system like this based on Splunk, and what was your experience while doing this?