@ProPoPop  You can increase the speed (throughput) of your Universal Forwarder, but this will also use more network bandwidth. To do this, change the maxKBps setting in the limits.conf file on the Universal Forwarder. More details are here: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf  I also recommend following this : https://community.splunk.com/t5/Splunk-Search/How-do-you-know-when-to-increase-the-bandwidth-limits/td-p/156419  It explains how to safely increase bandwidth and check its usage. You can monitor the bandwidth usage by checking the Universal Forwarder logs on the machine at: $SPLUNK_HOME/var/log/splunk/metrics.log  Or use this Splunk search to see the data: index=_internal source="*metrics.log" group=thruput ... View more

hi @ProPoPop  you might need to check the timestamp  format of the log... 2022-01-13T07:170:23Z ... View more