Now I want to deliver forwarder index data to index server due to network bandwidth? first , forwarder receiver data from windows all the time; second, at 0:00-3:00 forwarder deliver data to splunk index server. How to do it? Thanks in advance!
You can't put a schedule for when forwarding occurs, other than keeping the forwarder turned off and just turn it on when you need it.
Have a look at these other questions that cover pretty much the same thing: