splunk universal forwarder consuming cpu

[wecandoo]

I want to know abount how much splunk universal forwarder consume cpu.
Have any materials about that? I found everywhere in google and splunk documentation page but I counldn't found any materials
I want version 7.x material.
I want material as soon as possible.

thanks

[bpadmanbhachari]

For monitoring the resource usage on Splunk universal forwarder, you need to enable an add-on like below.

The introspection generator add-on is disabled by default on a universal forwarder. To enable: in the forwarder's $SPLUNK_HOME/etc/apps/introspection_generator_addon/local/app.conf, set

[install]
state = enabled

To monitor UF resource usage in Monitoring console, please follow below doc:
https://docs.splunk.com/Documentation/Splunk/7.2.6/DMC/Configureforwardermonitoring

[kmorris_splunk]

This can be hard to quantify, because it will depend on a lot of factors. Here is the documentation on monitoring files and directories:

https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Monitorfilesanddirectorieswithinputs.conf

A few things I have run into that can help keep CPU usage lower:

• Be as specific as possible with your inputs. Use of wildcards can be too greedy sometimes and you may be looking at files that aren't necessary.
• Be careful with the use of recursive=true for similar reasons. Unless you know you need all of the subdirectories in a directory, use this carefully.
• ignoreOlderThan can be helpful when first adding an input. Reading in a large file can initially cause high CPU usage until it catches up.

Hope this helps somewhat.

[nabeel652]

Check your inputs. You may be running some inputs (especially Windows Events) that may be consuming high CPU. Disable that and see if it gets any better