Naive use of '...' can cause CPU problems. The splunkd was using 80 to 90% of the CPU on our Forwarders. After debugging the issue we found that monitor folder traversals looking for new log files is very CPU expensive. We tracked our CPU issue to the following inputs.conf stanza:
[monitor://C:\Windows...LogFiles]
disabled = false
sourcetype = iis
crcSalt =
This replacement fixed our CPU issue:
[monitor://C:\WINDOWS\system32\LogFiles]
disabled = false
sourcetype = iis
crcSalt =
... View more