Increased CPU usage in indexers after installing Splunk for Unix/Linux add-on app,CPU Usage increase after installing Splunk App for Unix and Linux add-on in Splunk indexers?

[leanderzz]

Hi.

The Splunk for Unix/Linux add-on app includes a transforms.conf with a lot of regexps. After I installed this in my indexers, CPU usage for regexpreplacement has doubled. Are all these transformations/regexps applied to all incoming events? is that correct? I use a very small subset of this app, it sounds like a waste of resources to have all those regexps applied to all incoming events.

Thanks.

[xcheng_splunk]

Hi leanderzz,

transformations will apply to all incoming events. However, if you are only using a small subset of the app, you can only enable those data inputs from inputs.conf file. This way, transform.conf will only apply to the enabled data.
Just a reminder, only If the indexer is also a *nix host and you want to collect *nix data from it, should you enable the data and scripted inputs inside the Splunk_TA_nix add-on on the host. Otherwise, data collection should only happen on forwarders. Hope this helps.

Eric