All Apps and Add-ons

How can we manage Splunk Office 365 High CPU Usage?



since some time ago we are experiencing high CPU and/or memory usage related to the splunk_ta_o365 input addon.

The processes impacted are the python ones:

98.9 317938 splunk /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/splunk_ta_o365/bin/
97.7 317203 splunk /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/splunk_ta_o365/bin/
8.8 3058237 splunk splunkd -p 8089 restart


Updating didn't resolved the issue

Is anyone else experiencing this? How can we manage it?



Labels (1)
0 Karma


Since this is a supported add-on, filing a support case with Splunk would be the best option here and submitting a diag to them of the server where this add-on is installed. You can get a detailed RCA from them with a fix.

Thank you,
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...