You could also use SSHFS, which would allow you to mount the remote share and then have the forwarder monitor those files.
https://github.com/libfuse/sshfs
... View more
Concerning these mount options, I think that those would be fine. My only concern would be the sunit and swidth options, which should be set based on the hardware RAID options that you are using.
http://xfs.org/index.php/XFS_FAQ#Q:_How_to_calculate_the_correct_sunit.2Cswidth_values_for_optimal_performance
... View more
I wish I knew the answers to this.
I did add index=something_something to the local/input.conf file on the heavy forwarder and the data was ingested in that index.
Also, this will not run on a universal forwarder, since it needs Splunk's python to operate.
... View more