From Splunk Wiki
Deploying a lightweight forwarder
This configuration has been scaled back to do nothing but eat local files and send the unparsed data to another Splunk instance. The parsing seems to take about 80M on my box and most of the CPU time so removing the parsing has a big impact. This configuration will not work if the indexing server is heavily loaded since it will defer all processing to the indexer.
Note: if you use the remote parsing configuration you must change the splunktcp stanza in your inputs.conf to send data to parsingQueue not the indexQueue.
[splunktcp://9997] disabled = false queue = parsingQueue