All Apps and Add-ons

Increased CPU usage in indexers after installing Splunk for Unix/Linux add-on app,CPU Usage increase after installing Splunk App for Unix and Linux add-on in Splunk indexers?

leanderzz
New Member

Hi.

The Splunk for Unix/Linux add-on app includes a transforms.conf with a lot of regexps. After I installed this in my indexers, CPU usage for regexpreplacement has doubled. Are all these transformations/regexps applied to all incoming events? is that correct? I use a very small subset of this app, it sounds like a waste of resources to have all those regexps applied to all incoming events.

Thanks.

0 Karma

xcheng_splunk
Splunk Employee
Splunk Employee

Hi leanderzz,

transformations will apply to all incoming events. However, if you are only using a small subset of the app, you can only enable those data inputs from inputs.conf file. This way, transform.conf will only apply to the enabled data.
Just a reminder, only If the indexer is also a *nix host and you want to collect *nix data from it, should you enable the data and scripted inputs inside the Splunk_TA_nix add-on on the host. Otherwise, data collection should only happen on forwarders. Hope this helps.

Eric

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...