I have a customer that set up the followin sourcetype spec in props.conf. on an AIX installation. /opt/usi is at the root level. This is Splunk version 4.2.1
[source::.../opt/usi/portal/prod/vap/logs/*txt]
sourcetype=vignette
It appears that the 2 of the CPUs went to 100% when this statement was added.
We changed it to the following so that the dir path match was exact and surprise, CPU utilization on the Splunk Index machine went to 2%.
[source::///opt/usi/portal/prod/vap/logs/*txt]
sourcetype=vignette
The trouble is, I don't know why.......
Any suggestions?
Thanks Gerald
Here is the inputs.conf, this is running on a version 4.2.1 universal forwarder
# Inputs.conf for Splunk USI 04/27/11 For Universal Forwarders only
# Stored in /apps/splunk/splunkforwarder/etc/system/local
#
# Use APP server section for App servers and DB Server section for the Database server
# comment or Uncomment appropriate sections
#
# Define Which index to send to
# index = usi-training
#
# Common section1
index = _internal
[monitor:///apps/splunk/splunkforwarder/var/log/splunk/splunkd.log]
_TCP_ROUTING = *
index = usi-training
[monitor:///var/log]
index = usi-training
recursive = false
# If false, Splunk will not monitor subdirectories found within a monitored directory.
# Defaults to true.
disabled = false
followTail = 1
# Common section2
[monitor:///var/log/messages]
index = usi-training
recursive = false
disabled = false
followTail = 1
# App server section1
[monitor:///opt/usi/portal/prod/vap/logs]
index = usi-training
recursive = false
disabled = false
followTail = 1
# App server section2
[monitor:///opt/usi/portal/prod/tomcat1/logs]
index = usi-training
recursive = false
disabled = false
followTail = 1
# App server section3
[monitor:///opt/usi/portal/prod/tomcat2/logs]
index = usi-training
recursive = false
disabled = false
followTail = 1
# App server section4
[monitor:///opt/usi/portal/prod/tomcat3/logs]
index = usi-training
recursive = false
disabled = false
followTail = 1
# DB server section
#
Can you also show us your inputs.conf
, and if you have more than one?