topic Universal forwarder consuming 100% CPU. "WARN TimeoutHeap - Either time adjusted forwards by, or event loop was descheduled for 490844ms" in Getting Data In

Universal forwarder consuming 100% CPU. "WARN TimeoutHeap - Either time adjusted forwards by, or event loop was descheduled for 490844ms"

regriffith — Tue, 09 Aug 2016 16:49:01 GMT

Splunk consumes 100% of the CPU. Installed version is 6.4.

Splunk log:

07-13-2016 19:18:11.904 -0500 WARN  TimeoutHeap - Either time adjusted forwards by, or event loop was descheduled for 490844ms.
07-13-2016 19:18:11.904 -0500 WARN  TimeoutHeap - Either time adjusted forwards by, or event loop was descheduled for 490813ms.

Re: Universal forwarder consuming 100% CPU. "WARN TimeoutHeap - Either time adjusted forwards by, or event loop was descheduled for 490844ms"

regriffith — Tue, 09 Aug 2016 16:53:11 GMT

The system time was adjusted backwards by NTP. Changing to a different NTP server fixed the CPU issue. It appears that the UF can't handle this type of change.