Universal forwarder using 40-50% CPU and reports "(process) took longer than seems reasonable...Might indicate hardware or splunk limitations."

khagan — Tue, 17 May 2016 11:27:15 GMT

A Splunk Universal Forwarder has been using an unusual amount of CPU (between 40% and 50%), specifically by splunk-winevtlog.exe. Checking the splunkd.log shows this error occurring fairly constantly:

INFO PipelineComponent - <process> took longer than seems reasonable (xxxxx milliseconds) in callbackRunnerThread. Might indicate hardware or splunk limitations.

The offending process varies between "triggerCollection" and "metricsmanager:probeandreport". I can't find a clear indication of what either of these processes does.

The server has higher than the minimum recommendations - 4GB RAM and a 2.4 Ghz processor - so it shouldn't be hardware limitations. What other limitations can this error be referring to?

Re: Universal forwarder using 40-50% CPU and reports "(process) took longer than seems reasonable...Might indicate hardware or splunk limitations."

ddrillic — Wed, 18 May 2016 02:02:09 GMT

Similar message at ... took longer than seems reasonable...

topic Universal forwarder using 40-50% CPU and reports "(process) took longer than seems reasonable...Might indicate hardware or splunk limitations." in Getting Data In

Universal forwarder using 40-50% CPU and reports "(process) took longer than seems reasonable...Might indicate hardware or splunk limitations."

Re: Universal forwarder using 40-50% CPU and reports "(process) took longer than seems reasonable...Might indicate hardware or splunk limitations."