Where is the actual bottleneck on the heavy forwarder: network, memory, CPU? Forwarding to an indexer cluster should not be slower than forwarding to a single indexer, so I am not surprised that didn't help. There is no "collection interval" on the heavy forwarder; it should be able to "collect" the events asynchronously as they are sent over http/https. My guess is that you may be exceeding the bandwidth of a single event collector. Have you considered using 2 heavy forwarders and having the sender switch between them? If the resources on the heavy forwarder are not being taxed, then perhaps the sender trying to exceed its output bandwidth. ... View more