Monitoring Splunk

CPU Performances issues when running input powershell scripts

np75014
Explorer

Hi,

I'm using 4 powershell scripts to gather different infos on my machine (Windows server 2012) .
I run the scripts every 5 seconds and i can observe a lot of fluctuations on the CPU Usage who's jumping from 0 to 80% every 5 seconds (script execution).
My configuration follows the splunk recommandations and using empty scripts doesn't change anything.
Is that normal?
Do you have any solutions in order to prevent that?

np75014
Explorer

Thanks for your reply.
The reason why we don’t want to impact the CPU usage that much is because our solution is supposed to monitor the machine for abnormal usage. We do not want to be disruptive.
Running the script outside Splunk does not cause problems.

Do you have the same behavior, and do you confirm it’s expected behavior?

0 Karma

woodcock
Esteemed Legend

Yes, do something else useful on the server. Why do you care that CPU goes to 80%? If the server is sitting there totally idle (CPU=0%), then it makes perfect sense for the OS/scheduler to allot what would normally be excessive resources to a low priority task. I would expect and desire it to do exactly that; why do you expect otherwise?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...