We have 3 heavy forwarders and universal forwarders are sending data to these 3 HF. But the CPU usage on one of the heavy forwarder is high. Can I please know how to troubleshoot the issue, why the CPU utilization is high on one of HF.
Why are you using HF? Take a look at these posts and reconsider your use of HF.
http://answers.splunk.com/answers/231395/uf-hf-idx-architecture-is-there-a-recommended-numb-1.html - answer-230578
If you still want to use HF, perhaps you want to review the Troubleshooting Manual