Getting Data In

CPU usage using the lightforwarder

kkalmbach
Path Finder

I am using the light forwarder on AIX and running into high CPU usage (80-90% of a CPU).
We tracked it down to using ellipse in the monitor line in inputs.conf.
(even a "*" uses too much CPU).
We are using the ellipse so that we can deploy the same inputs.conf to several machines, each with a different directory path.

If we tighten it down to a single directory/file, things run great.

My question is:
Is there any way to have splunk traverse the directory tree less often (once a day or even less frequent), but still read files it already knows about in near real time?

I did not see anything in the doc about a setting like that.

mw
Splunk Employee
Splunk Employee

You should open a bug on this issue. You'd have to write your own script to look for new files.

0 Karma
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...