topic Re: splunkd is at 100% cpu, lag in indexing in Monitoring Splunk

splunkd is at 100% cpu, lag in indexing

oreni — Thu, 29 Dec 2011 19:29:33 GMT

Hello,

Yesterday I noticed that there's a substantial lag in event indexing to the default index (main). When inspecting the processes on my machine, I noticed that a single splunkd process running at 100% cpu.

I tried to restart splunk several time, but splunk gets to 100% cpu immediately and stays there.
I've opened ticket at support@splunk.com, but no response till now.
After deleting the index and re-indexing things got back to normal.

24h later I'm encountering the same problem.

The machine splunk is running on has 16 CPUs, 8GB RAM. ~200MB of data is being indexed daily, and there's no significant search activity as well.

Will appreciate any help with that.

Oren.

Re: splunkd is at 100% cpu, lag in indexing

oreni — Thu, 29 Dec 2011 21:30:13 GMT

Issue solved.

The problem was that Splunk was monitoring more than 4000 log files which were already indexed.

In inputs.conf, we simply added ignoreOlderThan = 2d which solved the problem.

Re: splunkd is at 100% cpu, lag in indexing

campbells — Mon, 09 May 2016 18:08:42 GMT

Thanks for the solution.

Changes made....Problem went away.

Re: splunkd is at 100% cpu, lag in indexing

ali_alnajjar_ve — Mon, 02 Jan 2017 18:47:56 GMT

Hi,

I assume this is not a Splunk indexer. right ?

Re: splunkd is at 100% cpu, lag in indexing

arunsundaram — Thu, 15 Jun 2017 14:07:55 GMT

Inputs .conf file exists in the host and not in the indexer and this is for the specific host only TA

Re: splunkd is at 100% cpu, lag in indexing

arunsundaram — Thu, 15 Jun 2017 14:08:51 GMT

the inputs.conf file exists in the host and this change need to be made at the host level. this will not affect the indexing