https://community.splunk.com/t5/Getting-Data-In/High-CPU-utilization-with-splunk-9-x-mainly-windows-UF/m-p/634458#M108567 <P>Run following search</P><P>&nbsp;</P><LI-CODE lang="markup">index=_internal source=*metrics.log* ratio &gt; 0.8| timechart max(ratio) by thread</LI-CODE><P>&nbsp;</P><P>Search will show threads using higher cpu.<BR />If one of the thread is&nbsp;&nbsp;<STRONG><SPAN class="">SplunkConfigChangeWatcherThread,&nbsp;</SPAN></STRONG>then disable new splunk config change tracker feature.</P><DIV class="">In server.conf</DIV><PRE>[config_change_tracker] disabled = true</PRE><P><BR />&nbsp;</P> Tue, 14 Mar 2023 19:41:31 GMT hrawat 2023-03-14T19:41:31Z https://community.splunk.com/t5/Getting-Data-In/High-CPU-utilization-with-splunk-9-x-mainly-windows-UF/m-p/634456#M108566 <P>After upgrade to 9.x, higher cpu utilization.</P> Tue, 14 Mar 2023 19:36:37 GMT https://community.splunk.com/t5/Getting-Data-In/High-CPU-utilization-with-splunk-9-x-mainly-windows-UF/m-p/634456#M108566 hrawat 2023-03-14T19:36:37Z https://community.splunk.com/t5/Getting-Data-In/High-CPU-utilization-with-splunk-9-x-mainly-windows-UF/m-p/634458#M108567 <P>Run following search</P><P>&nbsp;</P><LI-CODE lang="markup">index=_internal source=*metrics.log* ratio &gt; 0.8| timechart max(ratio) by thread</LI-CODE><P>&nbsp;</P><P>Search will show threads using higher cpu.<BR />If one of the thread is&nbsp;&nbsp;<STRONG><SPAN class="">SplunkConfigChangeWatcherThread,&nbsp;</SPAN></STRONG>then disable new splunk config change tracker feature.</P><DIV class="">In server.conf</DIV><PRE>[config_change_tracker] disabled = true</PRE><P><BR />&nbsp;</P> Tue, 14 Mar 2023 19:41:31 GMT https://community.splunk.com/t5/Getting-Data-In/High-CPU-utilization-with-splunk-9-x-mainly-windows-UF/m-p/634458#M108567 hrawat 2023-03-14T19:41:31Z