When applying compression on forwarder to indexer, I am suspecting it's more efficient due to splunk comsuming less Net bandwidth. Which allow more data to be transferred, that would result in higher data index rate through a forwarder.
So the question is,
Thanks in advance to the Splunkers out there!
Compression is handy as it will give you more efficient transmission of data, but this doesn't have have any bearing on the indexing as the data must be uncompressed prior to being indexed.
Hope this answers your question 🙂