I see this on my Debian 16.04 and 18.04 installs with both Splunk 6.6.5 and Splunk 7.2.4.
Fresh installs, no other data inputs and I get piled up rest.py processes.
From what I can tell is that it appears that Splunk is scheduling rest.py to run via its scheduler, but the rest.py script assumes that it is a run-once instance, since it loops after starting.
This seems to be a workaround but it is modifying the logic of the baboonbones code.
https://answers.splunk.com/answers/389392/issue-with-restpy-not-closing-and-running-out-of-m.html
... View more