I have Splunk Universal Forwarder 6.2.0 running and I see a lot of splunkd processes running upon starting/restarting this. This seems to be causing some performance bottlenecks in our setup.
Why is there a bunch of splunkds that is running? What do these do?
I have 5 scripted inputs each of which are running python scripts and 1 monitor input to monitor a log file.
Here is the inputs.conf with what we added in bold and everything else is from default/inputs.conf,
[default]
index = default
_rcvbuf = 1572864
host = bleaf3
[blacklist:$SPLUNK_HOME/etc/auth]
[monitor://$SPLUNK_HOME/var/log/splunk]
index = _internal
[monitor://$SPLUNK_HOME/etc/splunk.version]
_TCP_ROUTING = *
index = _internal
sourcetype = splunk_version
[batch://$SPLUNK_HOME/var/spool/splunk]
move_policy = sinkhole
crcSalt =
[batch://$SPLUNK_HOME/var/spool/splunk/...stash_new]
queue = stashparsing
sourcetype = stash_new
move_policy = sinkhole
crcSalt =
[fschange:$SPLUNK_HOME/etc]
pollPeriod = 600
signedaudit = true
recurse = true
followLinks = false
hashMaxSize = -1
fullEvent = false
sendEventMaxSize = -1
filesPerDelay = 10
delayInMills = 100
[udp]
connection_host = ip
[tcp]
acceptFrom = *
connection_host = dns
[splunktcp]
route = has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue
acceptFrom = *
connection_host = ip
[script]
interval = 60.0
start_by_shell = true
[SSL]
cipherSuite = ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
allowSslRenegotiation = true
sslQuietShutdown = false
**[script://$SPLUNK_HOME/bin/scripts/path/to/pythonscripts]
source = sourcename
sourcetype = sourcename
interval = 60
[script://$SPLUNK_HOME/bin/scripts/path/to/pythonscripts]
source = sourcename
sourcetype = sourcename
interval = 60
[script://$SPLUNK_HOME/bin/scripts/path/to/pythonscripts]
source = sourcename
sourcetype = sourcename
interval = 5
[monitor:///var/log/eos]
source = sourcename
sourcetype = sourcename
[script://$SPLUNK_HOME/bin/scripts/path/to/pythonscripts]
source = sourcename
sourcetype = sourcename
interval = 30
[script://$SPLUNK_HOME/bin/scripts/path/to/pythonscripts]
source = sourcename
sourcetype = sourcename
interval = 5**
Is Splunk's execprocessor that runs these scripts multithreaded, which causes the number of splunkd to show up in *ps* ?
Also, I would like to confirm, if one of these scripts hangs and is stuck past the set interval, does Splunk wait for it to finish execution before starting a new script or just keeps running the scripts for every interval?
↧