All Apps and Add-ons

Increased CPU usage in indexers after installing Splunk for Unix/Linux add-on app,CPU Usage increase after installing Splunk App for Unix and Linux add-on in Splunk indexers?

New Member


The Splunk for Unix/Linux add-on app includes a transforms.conf with a lot of regexps. After I installed this in my indexers, CPU usage for regexpreplacement has doubled. Are all these transformations/regexps applied to all incoming events? is that correct? I use a very small subset of this app, it sounds like a waste of resources to have all those regexps applied to all incoming events.


0 Karma

Splunk Employee
Splunk Employee

Hi leanderzz,

transformations will apply to all incoming events. However, if you are only using a small subset of the app, you can only enable those data inputs from inputs.conf file. This way, transform.conf will only apply to the enabled data.
Just a reminder, only If the indexer is also a *nix host and you want to collect *nix data from it, should you enable the data and scripted inputs inside the Splunk_TA_nix add-on on the host. Otherwise, data collection should only happen on forwarders. Hope this helps.


0 Karma