Splunk Enterprise

Why does Splunk logging driver have very high cpu usage?

cyberglad
Loves-to-Learn

using Http Event Collector, splunk loggin driver consumes too much CPU: 94-100%

anyone knows what's the reason behind it and how to det it down?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Short answer - your CPU is at constant 100% because your system is overutilized.

Long answer - most probably you're sending more data than the host can handle. Check your pipelines, check your inputs and outputs. Check your memory usage. There are so many things that can be wrong here.

Your question is about as detailed as "my car won't go when I press the accelerator pedal" when we don't know if you're out of gas, the battery is dead or whether you simply forgot to put it in gear.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...