How can we manage Splunk Office 365 High CPU Usage?

[davidemagni]

Hello,

since some time ago we are experiencing high CPU and/or memory usage related to the splunk_ta_o365 input addon.

The processes impacted are the python ones:

%CPU PID USER COMMAND
98.9 317938 splunk /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365_graph_api.py
97.7 317203 splunk /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/splunk_ta_o365/bin/splunk_ta_o365_graph_api.py
8.8 3058237 splunk splunkd -p 8089 restart

Updating didn't resolved the issue

Is anyone else experiencing this? How can we manage it?

Thanks!!

[shivanshu1593]

Since this is a supported add-on, filing a support case with Splunk would be the best option here and submitting a diag to them of the server where this add-on is installed. You can get a detailed RCA from them with a fix.