https://community.splunk.com/t5/Getting-Data-In/CPU-usage-using-the-lightforwarder/m-p/24386#M3841 <P>I am using the light forwarder on AIX and running into high CPU usage (80-90% of a CPU).<BR /> We tracked it down to using ellipse in the monitor line in inputs.conf.<BR /> (even a "*" uses too much CPU).<BR /> We are using the ellipse so that we can deploy the same inputs.conf to several machines, each with a different directory path.</P> <P>If we tighten it down to a single directory/file, things run great.</P> <P>My question is:<BR /> Is there any way to have splunk traverse the directory tree less often (once a day or even less frequent), but still read files it already knows about in near real time?</P> <P>I did not see anything in the doc about a setting like that.</P> Tue, 07 Jun 2011 21:03:28 GMT kkalmbach 2011-06-07T21:03:28Z https://community.splunk.com/t5/Getting-Data-In/CPU-usage-using-the-lightforwarder/m-p/24386#M3841 <P>I am using the light forwarder on AIX and running into high CPU usage (80-90% of a CPU).<BR /> We tracked it down to using ellipse in the monitor line in inputs.conf.<BR /> (even a "*" uses too much CPU).<BR /> We are using the ellipse so that we can deploy the same inputs.conf to several machines, each with a different directory path.</P> <P>If we tighten it down to a single directory/file, things run great.</P> <P>My question is:<BR /> Is there any way to have splunk traverse the directory tree less often (once a day or even less frequent), but still read files it already knows about in near real time?</P> <P>I did not see anything in the doc about a setting like that.</P> Tue, 07 Jun 2011 21:03:28 GMT https://community.splunk.com/t5/Getting-Data-In/CPU-usage-using-the-lightforwarder/m-p/24386#M3841 kkalmbach 2011-06-07T21:03:28Z https://community.splunk.com/t5/Getting-Data-In/CPU-usage-using-the-lightforwarder/m-p/24387#M3842 <P>You should open a bug on this issue. You'd have to write your own script to look for new files.</P> Tue, 07 Jun 2011 21:26:53 GMT https://community.splunk.com/t5/Getting-Data-In/CPU-usage-using-the-lightforwarder/m-p/24387#M3842 mw 2011-06-07T21:26:53Z