I see this article: https://splunk.my.site.com/customer/s/article/High-CPU-and-Memory-Usage-After-Splunk-UF-10-Upgrade   I've just tested out 9.4.5.0, and having same issue with it crashing servers.  9.4.4.0 seems to be safe for us.   So far we've seen these crashes on Windows 2016, not sure if it affects other OS versions or not. ... View more

However, if we do the below "fix", then AD SID and AD GUID strings won't be resolved to the actual AD names, which would be really annoying.  I think we're going to hold off on 10.0.0.0 until the evt_resolve_ad_obj feature is fixed and working again without crashing our servers.   [WinEventLog://Security] stanzas inside of inputs.conf: evt_resolve_ad_obj = 0 ... View more

Thanks, we'll test out the fix you linked to. ... View more

I was told to try the fix in: https://community.splunk.com/t5/Splunk-Enterprise/URGENT-All-splunk-forwarders-upgraded-to-10-0-version-are/td-p/751274 "Disabled the evt_resolve_ad_obj = 0 in Splunk_TA_windows app , logs have now ceased. "   For reference, this is the ticket I made.  Luckily, we were able to catch this issue in dev before deploying 10.0.0.0 to prod. https://community.splunk.com/t5/Splunk-Enterprise/In-UniversalForwarder-10-0-0-0-splunk-winevtlog-exe-process/td-p/752063 ... View more