Splunk Universal Forwarder and CPU accounting

[galagapp]

It looks like Splunk Universal Forwarder service on Linux enables CPU accounting or CPU shares. If this is enabled another program cannot manually assign scheduling.

Does Splunk Service need CPU accounting and can this be disabled when Splunk starts.

We want to determine if this CPUShares= setting is absolutely necessary for the service or if you have workarounds for setting CPU scheduling for the service in the legacy style.

[hrawat]

Yes you can comment out  CPUShares=1024 in Splunkd.service.
In future releases it will configurable to prevent CPUShares=1024 in Splunkd.service.