I have a WEC environment, and it seems that after we get past 400 machines on the Event Collector, latency is introduced.
In splunk, I often see delays of 1 - 5 hours. When I put the UF on the machines, no latency at all.
The problem is, that we have pushback on another agent being introduced.
The WEC machine is Server 2016, 16GB of Ram, 4 Cores.