topic Re: splunk universal forwarder consuming cpu in Getting Data In

splunk universal forwarder consuming cpu

wecandoo — Fri, 31 May 2019 01:33:28 GMT

I want to know abount how much splunk universal forwarder consume cpu.
Have any materials about that? I found everywhere in google and splunk documentation page but I counldn't found any materials
I want version 7.x material.
I want material as soon as possible.

thanks

Re: splunk universal forwarder consuming cpu

nabeel652 — Fri, 31 May 2019 02:54:53 GMT

Check your inputs. You may be running some inputs (especially Windows Events) that may be consuming high CPU. Disable that and see if it gets any better

Re: splunk universal forwarder consuming cpu

kmorris_splunk — Fri, 31 May 2019 12:54:28 GMT

This can be hard to quantify, because it will depend on a lot of factors. Here is the documentation on monitoring files and directories:

https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Monitorfilesanddirectorieswithinputs.conf

A few things I have run into that can help keep CPU usage lower:

Be as specific as possible with your inputs. Use of wildcards can be too greedy sometimes and you may be looking at files that aren't necessary.
Be careful with the use of recursive=true for similar reasons. Unless you know you need all of the subdirectories in a directory, use this carefully.
ignoreOlderThan can be helpful when first adding an input. Reading in a large file can initially cause high CPU usage until it catches up.

Hope this helps somewhat.

Re: splunk universal forwarder consuming cpu

bpadmanbhachari — Wed, 30 Sep 2020 00:46:14 GMT

For monitoring the resource usage on Splunk universal forwarder, you need to enable an add-on like below.

The introspection generator add-on is disabled by default on a universal forwarder. To enable: in the forwarder's $SPLUNK_HOME/etc/apps/introspection_generator_addon/local/app.conf, set

[install]
state = enabled

To monitor UF resource usage in Monitoring console, please follow below doc:
https://docs.splunk.com/Documentation/Splunk/7.2.6/DMC/Configureforwardermonitoring