Getting Data In

CPU usage using the lightforwarder

Path Finder

I am using the light forwarder on AIX and running into high CPU usage (80-90% of a CPU).
We tracked it down to using ellipse in the monitor line in inputs.conf.
(even a "*" uses too much CPU).
We are using the ellipse so that we can deploy the same inputs.conf to several machines, each with a different directory path.

If we tighten it down to a single directory/file, things run great.

My question is:
Is there any way to have splunk traverse the directory tree less often (once a day or even less frequent), but still read files it already knows about in near real time?

I did not see anything in the doc about a setting like that.

Splunk Employee
Splunk Employee

You should open a bug on this issue. You'd have to write your own script to look for new files.

0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...