All Apps and Add-ons

Increased CPU usage in indexers after installing Splunk for Unix/Linux add-on app,CPU Usage increase after installing Splunk App for Unix and Linux add-on in Splunk indexers?

leanderzz
New Member

Hi.

The Splunk for Unix/Linux add-on app includes a transforms.conf with a lot of regexps. After I installed this in my indexers, CPU usage for regexpreplacement has doubled. Are all these transformations/regexps applied to all incoming events? is that correct? I use a very small subset of this app, it sounds like a waste of resources to have all those regexps applied to all incoming events.

Thanks.

0 Karma

xcheng_splunk
Splunk Employee
Splunk Employee

Hi leanderzz,

transformations will apply to all incoming events. However, if you are only using a small subset of the app, you can only enable those data inputs from inputs.conf file. This way, transform.conf will only apply to the enabled data.
Just a reminder, only If the indexer is also a *nix host and you want to collect *nix data from it, should you enable the data and scripted inputs inside the Splunk_TA_nix add-on on the host. Otherwise, data collection should only happen on forwarders. Hope this helps.

Eric

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...