We have 3 heavy forwarders and universal forwarders are sending data to these 3 HF. But the CPU usage on one of the heavy forwarder is high. Can I please know how to troubleshoot the issue, why the CPU utilization is high on one of HF.
Why are you using HF? Take a look at these posts and reconsider your use of HF.
http://answers.splunk.com/answers/231395/uf-hf-idx-architecture-is-there-a-recommended-numb-1.html - answer-230578
http://blogs.splunk.com/2016/12/12/universal-or-heavy-that-is-the-question/
If you still want to use HF, perhaps you want to review the Troubleshooting Manual
http://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Troubleshootindexingperformance
