Perfmon events creeping up

[ELADMIN]

Hi, I have seen a steady increase in perfmon events or data in past 30 days. The number of hosts has been about same and overall production activity is the same. There was one host added during the 30 day time frame. I thought that host may have been the cause of the incrase. But, that new host is not even in the top 10 most active hosts.  The amount of overall perfmon data in proportion to the wineventlog data is increasing.  Please see the attached chart. Perfmon is represented with  brown bar, wineventlog is the green bar. 

I'm asking for any ideas that would help me in identifying the cause of this change. Thank you, in advance for any help. 

  

[KendallW]

Hi @ELADMIN Would you please share the search query used to generate the chart in your screenshot?

[ELADMIN]

Hi KendallW, 

This is the search: 

index=_internal (host=`sim_indexer_url` OR host=`sim_si_url`) sourcetype=splunkd group=per_Index_thruput series!=_*
| timechart minspan=30s per_second(kb) as kb by series

Then I selected 30 days on the time picker. 
Also selected visualization. I have attached another screenshot. I hope it helps.