Splunk® Enterprise

REST API Reference Manual

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Workload management endpoint descriptions

Manage system resources for search and indexing processes.

  • Create workload pools (CPU and memory resource groups).
  • Create workload rules to grant access and prioritize workload pools.
  • Assign scheduled and ad hoc searches to workload pools.

For more information, see About workload management in the Workload Management manual.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Authentication and Authorization

Username and password authentication is required for access to endpoints and REST operations.

Splunk users must have role and/or capability-based authorization to use REST endpoints. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls and click Users. To determine the capabilities assigned to a role, select Settings > Access controls and click Roles.

Splunk Cloud limitations

If you have a managed Splunk Cloud deployment with search head clustering and index clustering, the REST API supports access to the search head only. You can use the REST API to interact with the search head in your deployment. Using the REST API to access any other cluster member nodes is not supported. For example, index cluster management endpoints are not applicable to Splunk Cloud deployments.

Authorized users can access and configure other cluster members, including indexer, cluster master, and license master nodes, in the Splunk Cloud manager user interface. 


workloads/pools

https://<host>:<mPort>/services/workloads/pools

Endpoint to perform CRUD operations on workload pools.


Authentication and Authorization

  • GET requires the list_workload_pools capability.
  • POST and DELETE require the edit_workload_pools capability.


GET

List information about workload pools.


Request parameters
None

Returned values

Name Type Description
cpu_weight Number Specifies the fraction of the cpu assigned to this pool as a ratio of the total of cpu_weight across all pools. This fraction is then applied to the cpu shares assigned to the parent group.
mem_weight Number Specifies the fraction of the memory assigned to this pool as a ratio of the total of mem_weight across all pools. This fraction is then applied to the memory limits assigned to the parent group.
default_pool Boolean Only valid for the general stanza. Specifies the workload marked as the default pool.
ingest_pool Boolean Only valid for the general stanza. Specifies the workload pool marked as the ingest pool.

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/workloads/pools

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-pools</title>
  <id>https://localhost:8089/services/workloads/pools</id>
  <updated>2018-08-29T13:06:18-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/pools/_new" rel="create"/>
  <link href="/services/workloads/pools/_reload" rel="_reload"/>
  <link href="/services/workloads/pools/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>pool_1</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/pools/pool_1</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="cpu_weight">40</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="mem_weight">12</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

POST

Create and configure workload pools.


Request parameters

Name Type Description
cpu_weight Number Specifies the fraction of the cpu assigned to this pool as a ratio of the total of cpu_weight across all pools. This fraction is then applied to the cpu shares assigned to the parent group.
mem_weight Number Specifies the fraction of the memory assigned to this pool as a ratio of the total of mem_weight across all pools. This fraction is then applied to the memory limits assigned to the parent group.
default_pool Boolean Defines the current workload pool as the default pool.
ingest_pool Boolean Defines the current workload pool as the ingest pool.

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/pools/pool_1 -d "cpu_weight=40" 

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-pools</title>
  <id>https://localhost:8089/services/workloads/pools</id>
  <updated>2018-08-29T13:06:18-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/pools/_new" rel="create"/>
  <link href="/services/workloads/pools/_reload" rel="_reload"/>
  <link href="/services/workloads/pools/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>pool_1</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/pools/pool_1</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/pools/pool_1/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="cpu_weight">40</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="mem_weight">12</s:key>
      </s:dict>
    </content>
  </entry>
</feed>


DELETE

Delete workload pools.


Request parameters
None

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass -X DELETE https://localhost:8089/services/workloads/pools/pool_1

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-pools</title>
  <id>https://localhost:8089/services/workloads/pools</id>
  <updated>2018-08-29T13:11:12-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/pools/_new" rel="create"/>
  <link href="/services/workloads/pools/_reload" rel="_reload"/>
  <link href="/services/workloads/pools/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>


workloads/rules

https://<host>:<mPort>/services/workloads/rules

Endpoint to perform CRUD operations on workload rules.


Authentication and Authorization

  • GET requires the list_workload_rules capability.
  • POST and DELETE require the edit_workload_rules capability.


GET

List information about workload rules.


Request parameters
None

Returned values

Name Type Description
predicate String The predicate condition required to access the workload pool. Specify as <type=value>. Valid type is "app" or "role". For example, app=itsi, role=admin.
workload_pool String Specifies the workload pool associated with the workload rule.
order Boolean Specifies the evaluation order for this workload rule amongst a group of workload rules.

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/workloads/rules

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-rules</title>
  <id>https://localhost:8089/services/workloads/rules</id>
  <updated>2018-08-29T13:18:21-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/rules/_new" rel="create"/>
  <link href="/services/workloads/rules/_reload" rel="_reload"/>
  <link href="/services/workloads/rules/_acl" rel="_acl"/>
  <opensearch:totalResults>3</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>rule_1</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_1</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="order">3</s:key>
        <s:key name="predicate">app=search</s:key>
        <s:key name="workload_pool">default_search_pool</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>rule_2</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_2</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="order">1</s:key>
        <s:key name="predicate">role=admin</s:key>
        <s:key name="workload_pool">pool_1</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>rule_3</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_3</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="order">2</s:key>
        <s:key name="predicate">role=analyst</s:key>
        <s:key name="workload_pool">pool_2</s:key>
      </s:dict>
    </content>
  </entry>
</feed>


POST

Create and configure a workload rule.


Request parameters

Name Type Description
predicate String Specifies a single predicate condition that must match to access the workload pool. Specify as <type>=<value>, where valid <type> is "app" or "role". For example, a workload rule with predicate "app=itsi" maps all searches belonging to the ITSI app to the corresponding workload pool. Similarly, "role=admin" maps all searches for the admin role to the corresponding workload pool.

You can only specify one predicate for each workload rule. Multiple predicates are not supported.

workload_pool String Specifies the workload pool associated with the workload rule.
order Number Specifies the evaluation order for this workload rule amongst a group of workload rules. For newly created rules, the order cannot be specified. It can only be specified for existing rules.

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/rules/rule_1 -d "predicate=app=splunk_instrumentation"

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-rules</title>
  <id>https://localhost:8089/services/workloads/rules</id>
  <updated>2018-08-29T13:29:09-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/rules/_new" rel="create"/>
  <link href="/services/workloads/rules/_reload" rel="_reload"/>
  <link href="/services/workloads/rules/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>rule_1</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_1</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="order">3</s:key>
        <s:key name="predicate">app=splunk_instrumentation</s:key>
        <s:key name="workload_pool">default_search_pool</s:key>
      </s:dict>
    </content>
  </entry>
</feed>


DELETE

Delete workload rules.


Request parameters
None

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass -X DELETE https://localhost:8089/services/workloads/rules/rule_1

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-rules</title>
  <id>https://localhost:8089/services/workloads/rules</id>
  <updated>2018-08-29T13:29:47-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/rules/_new" rel="create"/>
  <link href="/services/workloads/rules/_reload" rel="_reload"/>
  <link href="/services/workloads/rules/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

workloads/config/enable

https://<host>:<mPort>/services/workloads/config/enable

Endpoint to enable workload management.


Authentication and Authorization
Requires the edit_workload_pools capability.


POST

Enable workload management


Request parameters
None

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/config/enable

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-config</title>
  <id>https://localhost:8089/services/workloads/config</id>
  <updated>2018-08-29T13:32:26-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/config/_reload" rel="_reload"/>
  <link href="/services/workloads/config/_acl" rel="_acl"/>
  <link href="/services/workloads/config/disable" rel="disable"/>
  <link href="/services/workloads/config/enable" rel="enable"/>
  <link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
  <link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

workloads/config/disable

https://<host>:<mPort>/services/workloads/config/disable

Endpoint to disable workload management.


Authentication and Authorization
Requires the edit_workload_pools capability.


POST

Disable workload management


Request parameters
None

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/config/disable

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-config</title>
  <id>https://localhost:8089/services/workloads/config</id>
  <updated>2018-08-29T13:33:55-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/config/_reload" rel="_reload"/>
  <link href="/services/workloads/config/_acl" rel="_acl"/>
  <link href="/services/workloads/config/disable" rel="disable"/>
  <link href="/services/workloads/config/enable" rel="enable"/>
  <link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
  <link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

workloads/config/get-base-dirname

https://<host>:<mPort>/services/workloads/config/get-base-dirname

Endpoint to get the name of the splunk parent cgroup.


Authentication and Authorization
Requires the edit_workload_pools capability.


GET

Get the name of the splunk parent cgroup.


Request parameters
None

Returned values

Name Type Description
workload_pool_base_dir_name String Specifies the parent level cgroup for splunk.

This setting applies only to systems running non-systemd setups. With systemd, this setting is ignored.

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/workloads/config/get-base-dirname

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-config</title>
  <id>https://localhost:8089/services/workloads/config</id>
  <updated>2018-08-29T14:49:48-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/config/_reload" rel="_reload"/>
  <link href="/services/workloads/config/_acl" rel="_acl"/>
  <link href="/services/workloads/config/disable" rel="disable"/>
  <link href="/services/workloads/config/enable" rel="enable"/>
  <link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
  <link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>workload-pool-base-path</title>
    <id>https://localhost:8089/services/workloads/config/workload-pool-base-path</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/services/workloads/config/workload-pool-base-path" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/workloads/config/workload-pool-base-path" rel="list"/>
    <link href="/services/workloads/config/workload-pool-base-path/_reload" rel="_reload"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>analyst</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="workload_pool_base_dir_name">splunk</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

workloads/config/set-base-dirname

https://<host>:<mPort>/services/workloads/config/set-base-dirname

Endpoint to set the name of the splunk parent cgroup.


Authentication and Authorization
Requires the edit_workload_pools capability.


POST

Set the name of the splunk parent cgroup.


Request parameters

Name Type Description
workload_pool_base_dir_name String Specifies the parent level cgroup for splunk.

This setting applies only to systems running non-systemd setups. With systemd, this setting is ignored.

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/workloads/config/set-base-dirname -d "workload_pool_base_dir_name=splunkbase"

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-config</title>
  <id>https://localhost:8089/services/workloads/config</id>
  <updated>2018-08-29T14:54:31-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/config/_reload" rel="_reload"/>
  <link href="/services/workloads/config/_acl" rel="_acl"/>
  <link href="/services/workloads/config/disable" rel="disable"/>
  <link href="/services/workloads/config/enable" rel="enable"/>
  <link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
  <link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

workloads/status

https://<host>:<mPort>/services/workloads/status

Endpoint to get information on the current status of workload management.


Authentication and Authorization
Requires the list_workload_pools capability.


GET

Get information on the current status of workload management.


Request parameters
None

Returned values

General information:

Name Type Description
default_pool String Specifies the workload pool marked as the default pool.
ingest_pool Number Specifies the workload pool marked as the ingest pool.
error_message String Displays the last error message observed while trying to enable workload management. This message is reset to empty on each successful enablement of workload management.
enabled Boolean Specifies whether or not workload management is enabled.
isSupported Boolean Specifies whether or not workload management is supported on this machine.
os_build String Specifies the operating system build information.
os_extended_name String Specifies the extended name of the underlying operating system.
os_name String Specifies the name of the underlying operating system.
os_version String Specifies the operating system version.

Workload pools:

Name Type Description
cpu_weight' Number Specifies the fraction of the cpu assigned to this pool as a ratio of the total of cpu_weight across all pools. This fraction is then applied to the cpu shares assigned to the parent group.
mem_weight Number Specifies the fraction of the memory assigned to this pool as a ratio of the total of mem_weight across all pools. This fraction is then applied to the memory limits assigned to the parent group.

Workload rules:

Name Type Description
predicate String Specifies the predicate condition that must match to access a workload pool. This must be of the format "app=<value>" or "role=<value". For example, app=itsi, role=admin. No other predicate formats are supported.
workload_pool String Specifies the workload pool to associate with the workload rule.
order Number Specifies the evaluation order for this workload rule amongst a group of workload rules.

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/workloads/status

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-status</title>
  <id>https://localhost:8089/services/workloads/status</id>
  <updated>2018-08-29T13:53:48-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/status/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>workload-management-status</title>
    <id>https://localhost:8089/services/workloads/status/workload-management-status</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/services/workloads/status/workload-management-status" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/workloads/status/workload-management-status" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>analyst</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list/>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="general">
          <s:dict>
            <s:key name="default_pool">default_search_pool</s:key>
            <s:key name="enabled">1</s:key>
            <s:key name="error_message"></s:key>
            <s:key name="ingest_pool">default_ingest_pool</s:key>
            <s:key name="isSupported">1</s:key>
            <s:key name="os_build">#1 SMP Wed Oct 19 11:24:13 EDT 2016</s:key>
            <s:key name="os_extended_name">Linux</s:key>
            <s:key name="os_name">Linux</s:key>
            <s:key name="os_version">3.10.0-514.el7.x86_64</s:key>
          </s:dict>
        </s:key>
        <s:key name="workload-pools">
          <s:dict>
            <s:key name="default_ingest_pool">
              <s:dict>
                <s:key name="cpu_group">/sys/fs/cgroup/cpu/system.slice/Splunkd.service/default_ingest_pool</s:key>
                <s:key name="cpu_weight">25</s:key>
                <s:key name="mem_group">/sys/fs/cgroup/memory/system.slice/Splunkd.service/default_ingest_pool</s:key>
                <s:key name="mem_weight">25</s:key>
              </s:dict>
            </s:key>
            <s:key name="default_search_pool">
              <s:dict>
                <s:key name="cpu_group">/sys/fs/cgroup/cpu/system.slice/Splunkd.service/default_search_pool</s:key>
                <s:key name="cpu_weight">25</s:key>
                <s:key name="mem_group">/sys/fs/cgroup/memory/system.slice/Splunkd.service/default_search_pool</s:key>
                <s:key name="mem_weight">25</s:key>
              </s:dict>
            </s:key>
            <s:key name="pool_2">
              <s:dict>
                <s:key name="cpu_group">/sys/fs/cgroup/cpu/system.slice/Splunkd.service/pool_2</s:key>
                <s:key name="cpu_weight">20</s:key>
                <s:key name="mem_group">/sys/fs/cgroup/memory/system.slice/Splunkd.service/pool_2</s:key>
                <s:key name="mem_weight">20</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="workload-rules">
          <s:dict>
            <s:key name="rule_3">
              <s:dict>
                <s:key name="order">1</s:key>
                <s:key name="predicate">role=analyst</s:key>
                <s:key name="workload_pool">pool_2</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
      </s:dict>
    </content>
  </entry>
</feed>

Last modified on 20 March, 2019
PREVIOUS
System endpoint descriptions
 

This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters