Why is the Windows Event Log indexing slow?

[spiced]

I indexed about 1GB of Windows Event Logs for a forensic analysis. I added the data by monitoring the folder where the Event Log files are located. The indexing took about 18 hours to complete. The load of server that I used for processing is low. I do not understand why processing 1GB of event logs takes so much time, I would expect it to take about 30 Minutes. Is there a way I can speed this process up? How can I find out what the bottlenech of the processing is? How do I find out when the processing is finished. I refreshed the search from time to time until I no additional events showed up?

[woodcock]

You probably have the default maxKBps which I think is 1024. Set this to 0 in limits.conf on your forwarders.

[spiced]

I only have an indexer, there is no forwarder. On the indexer maxKBps is already set to 0 so it must be something else.