Now I want to deliver forwarder index data to index server due to network bandwidth? first , forwarder receiver data from windows all the time; second, at 0:00-3:00 forwarder deliver data to splunk index server. How to do it? Thanks in advance!
You can't put a schedule for when forwarding occurs, other than keeping the forwarder turned off and just turn it on when you need it.
Have a look at these other questions that cover pretty much the same thing: http://splunk-base.splunk.com/answers/59916/can-you-set-a-certain-time-forwarding-occurs http://splunk-base.splunk.com/answers/58980/how-to-schedule-a-transfer-on-a-forwarder
