Solaris *nix Splunkd high load average

fizwit · ‎05-21-2013

Using the Splunk App for *nix on Solair. splunkd has a very high load average. In 15 seconds it did an lstat of 6659 files. Not sure why so many files are being monitored.

fizwit · ‎05-24-2013

problem solved:

modify: $SPLUNK_HOME/etc/apps/unix/local/inputs.conf
[monitor:///home/.../.bash_history]
disabled = 1

Splunk app for *NIX was spending all its time stating files in /home. (30% CPU) removing /home from monitor solved the problem.

Solaris *nix Splunkd high load average

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Join the Conversation

Solaris *nix Splunkd high load average

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance