I want to know abount how much splunk universal forwarder consume cpu.
Have any materials about that? I found everywhere in google and splunk documentation page but I counldn't found any materials
I want version 7.x material.
I want material as soon as possible.
thanks
For monitoring the resource usage on Splunk universal forwarder, you need to enable an add-on like below.
The introspection generator add-on is disabled by default on a universal forwarder. To enable: in the forwarder's $SPLUNK_HOME/etc/apps/introspection_generator_addon/local/app.conf, set
[install]
state = enabled
To monitor UF resource usage in Monitoring console, please follow below doc:
https://docs.splunk.com/Documentation/Splunk/7.2.6/DMC/Configureforwardermonitoring
This can be hard to quantify, because it will depend on a lot of factors. Here is the documentation on monitoring files and directories:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Monitorfilesanddirectorieswithinputs.conf
A few things I have run into that can help keep CPU usage lower:
Hope this helps somewhat.
Check your inputs. You may be running some inputs (especially Windows Events) that may be consuming high CPU. Disable that and see if it gets any better