Below link might help you understand how the data being send from the forwarder to the indexer. Forwarder basically sends in approximately 64KB blocks. There are few settings in outputs.conf/props.conf might help understand how the flow works between forwarder and indexer depending on the version of Splunk you are running
Explore these options: outputs.conf
Props.conf (in the latest versions of Splunk)
.conf.spec files should give you enough description of the settings.