All Apps and Add-ons
Highlighted

Why is an older Windows universal forwarder using more resources than a fresh install, even after an upgrade?

Splunk Employee
Splunk Employee

I installed a Windows universal forwarder on version 5.* 2 years ago, and upgraded it to 6.1.* recently.
Comparing the old upgraded UF versus a fresh install, I noticed that the old one was using much more resources (cpu/memory) to collect the Windows logs (perfmon, wineventlogs ...)

It seems that the only difference is the version of the Splunk Add-on for Microsoft Windows that was installed by the MSI installer.
I am not using a deployment server. Does it mean that the upgrade of Splunk does not upgrade the Windows TA?

Highlighted

Re: Why is an older Windows universal forwarder using more resources than a fresh install, even after an upgrade?

Splunk Employee
Splunk Employee

That is correct, upgrade does not install the latest version of SplunkTAwindows, only new installs do. I have seen cases like yours and upgrading SplunkTA to the latest version has resolve issues with High CPU/Mem. To find out what version you are on go to the etc/apps/splunkTA_Windows/default/app.conf and look at the build.

ex 4.6.3 = build 172675

4.7.1 = build 226229
latest 4.7.3 = build 237290

https://apps.splunk.com/app/742/

View solution in original post

Highlighted

Re: Why is an older Windows universal forwarder using more resources than a fresh install, even after an upgrade?

Splunk Employee
Splunk Employee

Installing the latest windows TA solved the performance problem.

0 Karma