Is anyone else experiencing any kind of performance hit after installing the Splunk Add-on for Microsoft Cloud Services? We installed the add-on in our Development environment (single server setup) and Processor Utilization (2 vCPU) almost immediately jumps to 100% and stays there? If we disable the app, CPU seems to normalize. We've not really even been able to get to the point of configuring the app...just curious if anyone else seeing similar results?
You might have an disk IO bottleneck which may be causing this. Try using premium disks or make a 4 disk spool at least.
thank you. This particular issue has only to do with poor housekeeping on the side of the Add on. There appears to be no solution for it. Having to deal with thousands of new files every hour without any consideration for reaping what's no longer relevant is, in my opinion, a poorly architected app.
We have encountered some problem with the add-on when pulling blob and a lot of blob in our container.
The "blob_mode" parameter takes only the value "append" so Splunk always try to pull all blob even if there's no modification after creation. The one-shot indexer seems not available.
I'm having the same issue.
The moment I disabled the add-on, CPU usage comes back to normal. Once I enabled it, it jumps straight to 100% and stays there.
Never even started to configure anything yet having this CPU usage issue.
Could anyone shed some light on this?
I was using the 6.3.3 version of Splunk with the Cloud Services v2.0.2 addon. After noticing that the CPU usage spiking terribly, I upgraded Splunk to the latest version - yet still the same.
splunkd.exe and python.exe seems to be spawning all over the place.
As of now, the Cloud Services add-on remains disabled.
-- Using a VM (vmWare) with 8GB RAM. Only PingFederate addon was enabled.
Running on 6.6.0, MSCS 2.1.0.
Running on Azure and not exactly overpowered as this is a Dev environment, but having this installed took both the searchhead and indexer from systems that spike to 100% (running ES 4.7.4) to systems that were pegged at 100% even after I disabled the two inputs I had created. I also note the absence of a disable, so it's not easy to quantify the impact as you have to shut down splunk and move the app out and restart splunk. The Platform Requirements section of the documentation seems a little underbaked given what we're seeing. Is there anything a little deeper in terms of system impact in terms of blob storage/table storage volumes etc?
Experiencing same issues, also on a 2 vCPU server and no configuration after initial install. I realize that 2 vCPU may not be adequate for production, but i'm just trying to test and the 95+% CPU utilization does not give me the "warm fuzzies" about this app. I'm using version 2.0.2 of the app and version 6.5.1 of Splunk Enterprise.