Using the Splunk App for *nix on Solair. splunkd has a very high load average. In 15 seconds it did an lstat of 6659 files. Not sure why so many files are being monitored.
disabled = 1
Splunk app for *NIX was spending all its time stating files in /home. (30% CPU) removing /home from monitor solved the problem.