Using the Splunk App for *nix on Solair. splunkd has a very high load average. In 15 seconds it did an lstat of 6659 files. Not sure why so many files are being monitored.
problem solved:
modify: $SPLUNK_HOME/etc/apps/unix/local/inputs.conf [monitor:///home/.../.bash_history] disabled = 1
Splunk app for *NIX was spending all its time stating files in /home. (30% CPU) removing /home from monitor solved the problem.
