My Splunk forwarder is forwarding ~5 events per second (per my Deployment Monitor on my search head). The maxKBps is set to 20,000 and Splunk is transferring at a rate of 16,000 KBps. Why is the number of events so low? I have 27TB of data (and then some) that need to be indexed, these are historical log files.
I do have indexer acknowledgement enabled in my environment as well.