You might be able to use the ignoreOlderThan setting in the inputs.conf, which controls how long ago the file has to have been last edited before Splunk ignores it altogether. The default setting of 0 causes your current issue of Splunk collecting and indexing all the historical data you give it.
Another option, if you don't care about losing data during downtime, is to set current_only to 1 (not recommended), which will cause Splunk to only collect data created while the forwarder is running.
... View more