A Splunk Universal Forwarder has been using an unusual amount of CPU (between 40% and 50%), specifically by splunk-winevtlog.exe. Checking the splunkd.log shows this error occurring fairly constantly:
INFO PipelineComponent - <process> took longer than seems reasonable (xxxxx milliseconds) in callbackRunnerThread. Might indicate hardware or splunk limitations.
The offending process varies between "triggerCollection" and "metricsmanager:probeandreport". I can't find a clear indication of what either of these processes does.
The server has higher than the minimum recommendations - 4GB RAM and a 2.4 Ghz processor - so it shouldn't be hardware limitations. What other limitations can this error be referring to?
