High CPU utilization with splunk 9.x ( mainly windows UF)

[hrawat_splunk]

After upgrade to 9.x, higher cpu utilization.

[hrawat_splunk · Accepted solution]

Run following search

index=_internal source=*metrics.log* ratio > 0.8| timechart max(ratio) by thread

Search will show threads using higher cpu.
If one of the thread is  SplunkConfigChangeWatcherThread, then disable new splunk config change tracker feature.

In server.conf

[config_change_tracker]
disabled = true