I recently installed a Universal Forwarder on an HA Windows server the other day and the guy who owns the server was complaining the CPU has nearly maxed out and shut down the box. He then took a shot in the dark and turned the Splunk service off and the CPU dropped, so it's pretty safe to assume it was the UF causing the problem. I'm a little surprised with this since it's a universal forwarder which has a small footprint for resource utilization.
So my question is, can someone point me in the right direction to find out why this happened? Does Splunk log the CPU utilization? Are there any logs I can look at to see what the issue is? Has anyone else experienced this issue before? Could it be misconfigured?
↧