initial spike on splunk consumer