Thanks for the reply.  I was able to resolve the issue today.  The issue was not load.  As mentioned, there are only a handful of files that actually match the criteria and they see infrequent updates - under 10 new entries per minute I would estimate. The issue ended up being the stanza itself being too vague.  I'm not sure how Splunk monitors/parses these internally but I believe there is room for improvement.  Once I split out the stanzas into a couple that cover the majority of our use-cases the memory dropped back down to around 200MB.   The new stanzas for anyone else finding this in the future eliminated the `...` wildcard and replaced it with a single-level one by including a couple stanzas for the common places these logs would be found: [monitor:///var/www/*/storage/logs/laravel*.log] index = lh-linux sourcetype = laravel_log disabled = 0 [monitor:///var/www/*/shared/storage/logs/laravel*.log] index = lh-linux sourcetype = laravel_log disabled = 0   Thank you kindly for taking the time to answer, there are some pieces of advice you mentioned that I wasn't as familiar with and it was good to learn more. ... View more