Make sure forwarder is not re reading the file. You can check for _indextime which should give you some clue when the events are indexes
Check for splunkd.log on the forwarder, At times you can see the forwarder is re reading the file due to crc mismatch which should help you find the root cause
