When using the Splunk Add-on for Microsoft Cloud Services, why is our CPU high when using more than 100 Azure Storage Inputs?

[ksoori]

We had this add-on installed on the indexer. All was fine until we created 100 Azure storage account inputs for monitoring the metric files.

The CPU jumped to 100 and stayed there till we deleted the inputs. How do we make this add-on performant? We would have to monitor more than 500 storage accounts, so are that many inputs possible?

We have a 8 core 2.30 GHz server Intel 64 bit sever
running Windows Server R2 Standard
40 GB RAM

[hkubavat_splunk]

It seems to many accounts to configured.

Can you try following approach?

1. Give the collection_interval different for the accounts.(Though it may cause the issue at the time of the restart but after restart after some time it should come to the normal)
2. You can setup the different heavy forwards with other accounts
3. One of the performance issue was resolved recently though it's related to read/write operation related under but it will help if you have that many account(ADDON-21216)