Getting Data In

splunk universal forwarder consuming cpu

Engager

I want to know abount how much splunk universal forwarder consume cpu.
Have any materials about that? I found everywhere in google and splunk documentation page but I counldn't found any materials
I want version 7.x material.
I want material as soon as possible.

thanks

Splunk Employee
Splunk Employee

For monitoring the resource usage on Splunk universal forwarder, you need to enable an add-on like below.

The introspection generator add-on is disabled by default on a universal forwarder. To enable: in the forwarder's $SPLUNKHOME/etc/apps/introspectiongenerator_addon/local/app.conf, set

[install]
state = enabled

To monitor UF resource usage in Monitoring console, please follow below doc:
https://docs.splunk.com/Documentation/Splunk/7.2.6/DMC/Configureforwardermonitoring

0 Karma

Splunk Employee
Splunk Employee

This can be hard to quantify, because it will depend on a lot of factors. Here is the documentation on monitoring files and directories:

https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Monitorfilesanddirectorieswithinputs.conf

A few things I have run into that can help keep CPU usage lower:

  • Be as specific as possible with your inputs. Use of wildcards can be too greedy sometimes and you may be looking at files that aren't necessary.
  • Be careful with the use of recursive=true for similar reasons. Unless you know you need all of the subdirectories in a directory, use this carefully.
  • ignoreOlderThan can be helpful when first adding an input. Reading in a large file can initially cause high CPU usage until it catches up.

Hope this helps somewhat.

Builder

Check your inputs. You may be running some inputs (especially Windows Events) that may be consuming high CPU. Disable that and see if it gets any better

0 Karma