Splunk Universal Forwarder and CPU accounting

galagapp — Wed, 16 Mar 2022 22:04:16 GMT

It looks like Splunk Universal Forwarder service on Linux enables CPU accounting or CPU shares. If this is enabled another program cannot manually assign scheduling.

Does Splunk Service need CPU accounting and can this be disabled when Splunk starts.

We want to determine if this CPUShares= setting is absolutely necessary for the service or if you have workarounds for setting CPU scheduling for the service in the legacy style.

Re: Splunk Universal Forwarder and CPU accounting

hrawat — Wed, 17 May 2023 15:18:54 GMT

Yes you can comment out CPUShares=1024 in Splunkd.service.
In future releases it will configurable to prevent CPUShares=1024 in Splunkd.service.

topic Re: Splunk Universal Forwarder and CPU accounting in Installation

Splunk Universal Forwarder and CPU accounting

Re: Splunk Universal Forwarder and CPU accounting