To reply to your question about latency:
The regex is efficient, i tried it on regex101.
On indexing time, there is only one regex that i wrote for firewall incoming data to only accept blocked traffic logs. And because there are a lot of logs sent by the firewall, the indexer should filter all of those logs on indexing time to filter them and only take the blocked traffic to index it.
Question: How can adding an indexer help me in this case, will the two indexers work on filtering logs in indexing time together?
Maybe better option in your case is use something else (rsyslog, syslog-ng or cribl) before take those logs into splunk? I suppose that those are more powerful to do that kind of event dropping than splunk is? Also you could check if you can configure FW to send only wanted events not all.
Additional indexers help by sharing the workload. If data is distributed across all indexers then they each will work on filtering logs. They'll also share the search load to help make searches run faster.
This is true. The more work the indexer has to do before it indexes data the longer ingestion takes.
There are some things you can do about it.
How much latency are we talking about?