I upgraded to Splunk Forwarder 10.0.1 yesterday on a PC running Windows10 with 32GB of RAM. The process name is "Monitor windows event log" which is called from "splunk-wineventlog.exe" This process sat consuming over 28GB of RAM!  I reverted back to 9.4.3 which consumes about 150MB of RAM. This seems to affect physical servers, VM's and PC's. Luckily I didn't deploy it to too many machines and it's strange that some are running the update with no memory issues as yet. I have had to revert the forwarder on 3 machines but still testing on half a dozen others.   ... View more