https://community.splunk.com/t5/Splunk-Search/Solaris-nix-Splunkd-high-load-average/m-p/41978#M9761 <P>problem solved:</P> <P>modify: $SPLUNK_HOME/etc/apps/unix/local/inputs.conf<BR /> [monitor:///home/.../.bash_history]<BR /> disabled = 1</P> <P>Splunk app for *NIX was spending all its time stating files in /home. (30% CPU) removing /home from monitor solved the problem.</P> Mon, 28 Sep 2020 13:58:28 GMT fizwit 2020-09-28T13:58:28Z https://community.splunk.com/t5/Splunk-Search/Solaris-nix-Splunkd-high-load-average/m-p/41977#M9760 <P>Using the Splunk App for *nix on Solair. splunkd has a very high load average. In 15 seconds it did an lstat of 6659 files. Not sure why so many files are being monitored. </P> Wed, 22 May 2013 00:00:25 GMT https://community.splunk.com/t5/Splunk-Search/Solaris-nix-Splunkd-high-load-average/m-p/41977#M9760 fizwit 2013-05-22T00:00:25Z https://community.splunk.com/t5/Splunk-Search/Solaris-nix-Splunkd-high-load-average/m-p/41978#M9761 <P>problem solved:</P> <P>modify: $SPLUNK_HOME/etc/apps/unix/local/inputs.conf<BR /> [monitor:///home/.../.bash_history]<BR /> disabled = 1</P> <P>Splunk app for *NIX was spending all its time stating files in /home. (30% CPU) removing /home from monitor solved the problem.</P> Mon, 28 Sep 2020 13:58:28 GMT https://community.splunk.com/t5/Splunk-Search/Solaris-nix-Splunkd-high-load-average/m-p/41978#M9761 fizwit 2020-09-28T13:58:28Z