We are running EOS 4.22.3 M, SplunkUniversalForwarder 6.6.2 and AristaApp 1.6.0, one thing we noticed with all these latest extensions is the high CPU load averages when running splunk-forwarder. If we shutdown the splunk load averages goes down to an average of 0.40 per minute, with splunk running it is always more than 1.00.
Below are the details.
A: available | NA: not available | I: installed | NI: not installed | F: forced
Software image version: 4.22.3M
Uptime: 7 weeks, 3 days, 1 hours and 13 minutes
oblf12-idev#show run sec splunk-forward
Is there any Arista recommended Index intervals, we are trying to understand why the high CPU usage with current splunk. Previously we were running EOS 4.20.10M, SUF 7.1.2, AristaApp 1.5.0 and CPU load averages were pretty normal.
Please suggest what are the recommended versions of extensions for EOS 4.22.3M and index intervals.
The high CPU load could be observed because of the short interval time between the indexes in the said EOS version. Based on our testing and understanding, the following steps have brought the CPU load down:
If you have any further questions please feel free to reach out to firstname.lastname@example.org
Post your Answer
You must be logged in to post an answer.