All Apps and Add-ons

Splunk Forwarder Service/ Windows Infrastructure App Causing PowerShell.exe to use 50% CPU + continuously growing Memory

mgrasber
Engager

Hi Guys - apologies ahead of time for my ignorance as I'm a rookie.

I have the splunk forwarder installed on a DC running 2012 R2. Service runs fine with no apps installed. When I stop the service, install TA-DNSServer-NT6 and TA-DomainController-NT6 for the windows infrastructure splunk app, and restart the service, Windows Powershell hovers consistently at 50+% CPU in task manager. Memory usage starts around a few hundred MB and grows by about 3mb/s without stopping. Right now it's at about 2050mb of memory.

All the correct information looks like it's being collected in splunk. I can see LDAP information, DS client binds, etc...

We have 2 other DCs on 2008 R2 that are forwarding information using the Splunk App For AD and the task manager shows no similarities.

Any help would be appreciated. Thanks!

0 Karma
1 Solution

mgrasber
Engager

I'm an idiot - Didn't even notice that there is an addon specifically for 2012 R2 that comes with this app (TA-DomainController-2012R2). Will leave this here just in case anyone else has the same brain fart. Thanks everyone.

View solution in original post

mgrasber
Engager

I'm an idiot - Didn't even notice that there is an addon specifically for 2012 R2 that comes with this app (TA-DomainController-2012R2). Will leave this here just in case anyone else has the same brain fart. Thanks everyone.

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...