About workload management
Workload management is a policy-based system resource manager that lets you allocate compute and memory resources to search, indexing, and other processes in Splunk Enterprise.
With large numbers of searches running concurrently across your deployment, inefficient allocation of system resources can impact search execution, and cause latency, skipped searches, and other performance issues. In some cases, high-priority searches might not be allocated adequate system resources, while less important searches are allocated too much.
Workload management addresses these issues and helps you optimize resource usage by letting you control the amount of system resources allocated to individual search processes in Splunk Enterprise.
Workload management lets you:
- Reserve system resources for search and indexing processes.
- Prioritize critical search workloads.
- Prevent over-usage of system resources.
- Avoid data-ingestion latency due to heavy search load.
- Create rules to control access to resources based on app or role.
To learn more about workload management, see How workload management works.
For prerequisite Linux configuration requirements, see Set up Linux for workload management.
For workload management configuration instructions, see Configure workload management.
To learn how to allocate resources to searches, see Assign searches to workload pools.
| How workload management works |
This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10
Download manual
Feedback submitted, thanks!