Rather than deleting the Eventtype.  Check the permission and see if it is set to global which most are by default.  Change it to be within app and the search that runs will not use that Knowledge Object.   ... View more

In the cases of most modular inputs, interval is not what you think it is. Interval is how often to restart the mod input if it exits, either on purpose or on error/crash. For the registry monitor -- it runs continuously. There is a driver component and a usermode component. The driver monitors the registry for the key(s)/subkeys requested in the stanza (and by operation). The usermode component pulls that information from the driver. If you are getting too much data, maybe you are requesting too broad a collection to monitor. The registry is heavily used by everything in a windows OS. ... View more

Taken from Splunk Release Notes Version 3.0.0 of the Splunk Add-on for IBM WebSphere Application Server is compatible with the following software, CIM versions, and platforms. Splunk platform versions 6.0 and above CIM 4.2 and above Platforms Platform independent Vendor Products IBM WebSphere Application Server versions 7.0.0 - 8.5.5 ... View more

Installing the latest windows TA solved the performance problem. ... View more

Are you running Splunk on linux (RHEL)? How much memory do you have on the server? Have you looked at this: http://docs.splunk.com/Documentation/Splunk/6.2.1/ReleaseNotes/SplunkandTHP This may cause Splunk to under perform with THP enabled and even not release memory back to the server. The linux out of memory manager can also start to kill splunkd if it consumes too much memory. http://www.oracle.com/technetwork/articles/servers-storage-dev/oom-killer-1911807.html ... View more