Getting Data In

Why am I seeing Splunk-Winevtlog.exe Initial High CPU Utilization on Installation of Windows Splunk Forwarder v 7.1.2?

ajdyer2000
Path Finder

Hi,

Right after the initial install of the Splunk Windows Forwarder the Splunk-Winevtlog.exe process consistently runs at 25% utilization.

This will happen for 3 to 5 hours then will go down to zero and won't do it again.

Wondering if anyone else may have seen this and how to prevent this from happening.

The forwarders are being installed on Windows 10 devices.

Thanks for all the help I'm getting on this forum. 🙂

Alan

0 Karma

HiroshiSatoh
Champion

At the time of initial startup, I think that the load is taken to acquire all past event logs.

It will not happen unless we acquire the past.

inputs.conf

[WinEventLog://<name>]
current_only = 1

Restart splunk.

By setting current_only to 1 (enabled), you will get "only Windows event logs generated while Splunk is running".
By default, it is set to 0 (invalid).

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...