I'll add a bit more to this.. As already mentioned, if you're just batching files and not doing parsing / masking / editing of the data, then you should look at using a UF instead of a HF.
Additionally, assuming that your hardware does have capacity available, as in CPU and Memory, you can increase the ingestion pipelines on the forwarder to 2, 3, or even more. Read here for more details on this : https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Pipelinesets
It's important to understand that you effectively double your ingestion capacity for the pipelines added. This could have upstream impact if your intermediate and indexing tiers are experiencing any type of latency or resource related issues.
... View more