I'd start by checking queues. Queue backup can occur on indexers or forwarders. You can check queues for the indexers by going to your Monitoring Console and going to Indexing-->Performance-->Indexing Performance: Deployment. You can check filling queues on your forwarders with the search:
index=_internal group=queue | eval percfull=((current_size_kb/max_size_kb)*100) | search percfull>80 | dedup host, name | table _time host name current_size_kb max_size_kb
You can check thruput on your forwarders by searching for these events:
INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
Hosts that throw that event may be candidates for increasing maxKbps in limits.conf.
(https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Troubleshootingeventsindexingdelay#Possible_thruput_limits)
... View more