Splunk® Enterprise

REST API Reference Manual

Splunk Enterprise version 8.2 is no longer supported as of September 30, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Workload management endpoint descriptions

Manage system resources for search and indexing processes.

  • Create workload pools (CPU and memory resource groups).
  • Create workload rules to grant access and prioritize workload pools.
  • Assign scheduled and ad hoc searches to workload pools.

For more information, see About workload management in the Workload Management manual.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Authentication and Authorization

Username and password authentication is required for access to endpoints and REST operations.

Splunk users must have role and/or capability-based authorization to use REST endpoints. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls and click Users. To determine the capabilities assigned to a role, select Settings > Access controls and click Roles.

App and user context

Typically, knowledge objects, such as saved searches or event types, have an app/user context that is the namespace. For more information about specifying a namespace, see Namespace in the REST API User Manual.

Splunk Cloud Platform limitations

As a Splunk Cloud Platform user, you are restricted to interacting with the search tier only with the REST API. Workload management endpoints are generally not accessible in Splunk Cloud Platform.

See Access requirements and limitations for the Splunk Cloud Platform REST API in the the REST API Tutorials manual for more information.

workloads/categories

https://<host>:<mPort>/services/workloads/categories

List and edit workload categories.

There are three predefined categories: search, ingest, and misc. You cannot create or delete categories. You can only edit and list them.


Authentication and Authorization

  • GET requires the list_workload_pools capability.
  • POST requires the edit_workload_pools capability.


GET

List information about workload categories.


Request parameters
None

Returned values

Name Type Description
cpu_weight Number Specifies the fraction of the cpu assigned to this category as a ratio of the total of cpu_weight across all categories. This fraction is then applied to the cpu shares assigned to the parent group. The value must be > 0 and <= 100.
mem_weight Number Specifies the percentage of memory assigned to this category as a percent of the parent group. The total amount of memory limit for this category is a percentage of the value assigned to the parent group. The value must be > 0 and <= 100.

Example request and response

XML Request 

curl -k -u admin:pass https://localhost:8089/services/workloads/categories/search

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-categories</title>
  <id>https://qa-ubuntu-022:8089/services/workloads/categories</id>
  <updated>2019-03-20T14:11:59-07:00</updated>
  <generator build="8c85c1fbcc8c" version="7.3.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/categories/_reload" rel="_reload"/>
  <link href="/services/workloads/categories/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>search</title>
    <id>https://qa-ubuntu-022:8089/servicesNS/nobody/system/workloads/categories/search</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/system/workloads/categories/search" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/system/workloads/categories/search" rel="list"/>
    <link href="/servicesNS/nobody/system/workloads/categories/search/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/system/workloads/categories/search" rel="edit"/>
    <link href="/servicesNS/nobody/system/workloads/categories/search/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="cpu_allocated_percent">70.00</s:key>
        <s:key name="cpu_weight">70</s:key>
        <s:key name="cpu_weight_sum">100</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">system</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="eai:attributes">
          <s:dict>
            <s:key name="optionalFields">
              <s:list>
                <s:item>cpu_weight</s:item>
                <s:item>mem_weight</s:item>
              </s:list>
            </s:key>
            <s:key name="requiredFields">
              <s:list/>
            </s:key>
            <s:key name="wildcardFields">
              <s:list/>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="mem_allocated_percent">60.00</s:key>
        <s:key name="mem_weight">60</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

POST

Edit workload categories.


Request parameters

Name Type Description
cpu_weight Number Specifies the fraction of the cpu assigned to this category as a ratio of the total of cpu_weight across all categories. This fraction is then applied to the cpu shares assigned to the parent group. The value must be > 0 and <= 100
mem_weight Number Specifies the percentage of memory assigned to this pool as a percent of the parent group. The total amount of memory limit for this pool is a percentage of the value assigned to the parent group. The value must be > 0 and <= 100.

Returned values
None


Example request and response

XML Request 

curl -k -u admin:pass https://localhost:8089/services/workloads/categories/search -d cpu_weight=40 -d mem_weight=50

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-categories</title>
  <id>https://qa-ubuntu-022:8089/services/workloads/categories</id>
  <updated>2019-03-20T14:21:44-07:00</updated>
  <generator build="8c85c1fbcc8c" version="7.3.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/categories/_reload" rel="_reload"/>
  <link href="/services/workloads/categories/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>search</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/categories/search</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/categories/search" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/categories/search" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/categories/search/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/categories/search" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/categories/search/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="cpu_allocated_percent">57.14</s:key>
        <s:key name="cpu_weight">40</s:key>
        <s:key name="cpu_weight_sum">70</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="mem_allocated_percent">60.00</s:key>
        <s:key name="mem_weight">60</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

workloads/pools

https://<host>:<mPort>/services/workloads/pools

Perform CRUD operations on workload pools.


Authentication and Authorization

  • GET requires the list_workload_pools capability.
  • POST and DELETE require the edit_workload_pools capability.


GET

List information about workload pools.


Request parameters
None

Returned values

Name Type Description
cpu_weight Number Specifies the fraction of the cpu assigned to this pool as a ratio of the total of cpu_weight across all pools in a category. This fraction is then applied to the cpu shares assigned to the category.
mem_weight Number Specifies the percentage of the memory assigned to this pool as a percent of the category. The total amount of memory limit for this pool is a percentage of the value assigned to the category.
category string Specifies the category in which a poll is created. Can be either "search", "ingest", or "misc".
default_category_pool Boolean Specifies the workload pool marked as default pool for its category. This property is defined per workload_pool stanza. Default is 0.
default_pool Boolean Specifies a workload pool defined in the search category as the default pool for the search category.

deprecated parameter retained for backwards compatibility with 7.2.x

ingest_pool Boolean Specifies a workload-pool defined in the ingest category as the default pool for the ingest category.

deprecated parameter retained for backwards compatibility with 7.2.x

Example request and response

XML Request 

curl -k -u admin:pass https://localhost:8089/services/workloads/pools/search_pool_1

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-pools</title>
  <id>https://qa-ubuntu-022:8089/services/workloads/pools</id>
  <updated>2019-03-21T11:58:38-07:00</updated>
  <generator build="8c85c1fbcc8c" version="7.3.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/pools/_new" rel="create"/>
  <link href="/services/workloads/pools/_reload" rel="_reload"/>
  <link href="/services/workloads/pools/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>search_pool_1</title>
    <id>https://qa-ubuntu-022:8089/servicesNS/nobody/search/workloads/pools/search_pool_1</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_1" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_1" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_1/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_1" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_1" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_1/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_1/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="category">search</s:key>
        <s:key name="cpu_allocated_percent">28.57</s:key>
        <s:key name="cpu_shares">512</s:key>
        <s:key name="cpu_weight">20</s:key>
        <s:key name="default_category_pool">1</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="eai:attributes">
          <s:dict>
            <s:key name="optionalFields">
              <s:list>
                <s:item>cpu_weight</s:item>
                <s:item>default_category_pool</s:item>
                <s:item>default_pool</s:item>
                <s:item>ingest_pool</s:item>
                <s:item>mem_weight</s:item>
              </s:list>
            </s:key>
            <s:key name="requiredFields">
              <s:list/>
            </s:key>
            <s:key name="wildcardFields">
              <s:list/>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="mem_allocated_percent">12.00</s:key>
        <s:key name="mem_limit">12884901888</s:key>
        <s:key name="mem_weight">20</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

POST

Create and configure workload pools.


Request parameters

Name Type Description
cpu_weight Number Specifies the fraction of the cpu assigned to this pool as a ratio of the total of cpu_weight across all pools. This fraction is then applied to the cpu shares assigned to the parent group.
mem_weight Number Specifies the fraction of the memory assigned to this pool as a ratio of the total of mem_weight across all pools. This fraction is then applied to the memory limits assigned to the parent group.
category string Specifies the category in which a poll is created. Can be either "search", "ingest", or "misc".
default_category_pool Boolean Specifies the workload pool marked as default pool for its category. This property is defined per workload_pool stanza. Default is 0.
default_pool Boolean Specifies a workload pool defined in the search category as the default pool for the search category.

deprecated parameter retained for backwards compatibility with 7.2.x

ingest_pool Boolean Specifies a workload-pool defined in the ingest category as the default pool for the ingest category.

deprecated parameter retained for backwards compatibility with 7.2.x

Returned values
None


Example request and response

XML Request 

curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/pools -d name=search_pool_3 -d category=search -d cpu_weight=40 -d mem_weight=60 -d default_category_pool=1

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-pools</title>
  <id>https://qa-ubuntu-022:8089/services/workloads/pools</id>
  <updated>2019-03-21T12:05:12-07:00</updated>
  <generator build="8c85c1fbcc8c" version="7.3.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/pools/_new" rel="create"/>
  <link href="/services/workloads/pools/_reload" rel="_reload"/>
  <link href="/services/workloads/pools/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>search_pool_3</title>
    <id>https://qa-ubuntu-022:8089/servicesNS/nobody/search/workloads/pools/search_pool_3</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_3" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_3" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_3/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_3" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_3" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_3/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/pools/search_pool_3/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="category">search</s:key>
        <s:key name="cpu_allocated_percent">28.57</s:key>
        <s:key name="cpu_shares">0</s:key>
        <s:key name="cpu_weight">40</s:key>
        <s:key name="default_category_pool">1</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="mem_allocated_percent">36.00</s:key>
        <s:key name="mem_limit">0</s:key>
        <s:key name="mem_weight">60</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

workloads/rules

https://<host>:<mPort>/services/workloads/rules

Perform CRUD operations on workload rules and admission rules.


Authentication and Authorization

  • GET requires the list_workload_rules capability.
  • POST and DELETE require the edit_workload_rules capability.


GET

List information about workload rules and admission rules.


Request parameters

Name Type Description
workload_rule_type String Specifies the rule type. Supported values are:

search_filter: returns admission rules only.
all: returns both admission rules and workload rules.

To list workload rule information only, specify the endpoint URI with optional rule_name, for example services/workloads/rules/rule_name.


Returned values

Name Type Description
predicate String Specifies the predicate (condition) that a search must meet for the specified action to be taken.
action String Specifies the action taken when a search meets the predicate (condition).
workload_pool String Specifies the workload pool associated with the workload rule.
order Boolean Specifies the evaluation order for this workload rule amongst a group of workload rules.

Example request and response

XML Request 

curl -k -u admin:pass https://localhost:8089/services/workloads/rules

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-rules</title>
  <id>https://localhost:8089/services/workloads/rules</id>
  <updated>2018-08-29T13:18:21-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/rules/_new" rel="create"/>
  <link href="/services/workloads/rules/_reload" rel="_reload"/>
  <link href="/services/workloads/rules/_acl" rel="_acl"/>
  <opensearch:totalResults>3</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>rule_1</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_1</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_1/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="order">3</s:key>
        <s:key name="predicate">app=search</s:key>
        <s:key name="workload_pool">default_search_pool</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>rule_2</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_2</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_2/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="order">1</s:key>
        <s:key name="predicate">role=admin</s:key>
        <s:key name="workload_pool">pool_1</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>rule_3</title>
    <id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_3</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/rules/rule_3/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="order">2</s:key>
        <s:key name="predicate">role=analyst</s:key>
        <s:key name="workload_pool">pool_2</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

POST

Create and configure, or enable/disable a workload rule or an admission rule.


Request parameters

Name Type Description
name String Specifies the name of the workload rule or admission rule.
predicate String Specifies a predicate (condition) that must be true for a search to gain access to the workload pool. The syntax is <type>=<value>, with optional AND, OR, NOT, (). For example, app=search AND role=power maps all searches belonging to both the Search app and the power role to the designated workload pool.


Valid predicate <type> are app, role, index, user, search_type, search_mode, search_time_range, and runtime. For valid predicate type values, see Predicate type values in the Workload Management manual.

You can only specify one predicate for each workload rule. Multiple predicates are not supported.

action String For workload rules: Specifies the action taken when a search meets the specified predicate (condition). Supported actions are alert, move and abort.


For admission rules: You must specify filter as the action.

workload_pool String Specifies the workload pool associated with the workload rule. Specifies the destination workload pool for the move action.
order Number Specifies the evaluation order for this workload rule amongst a group of workload rules. For newly created rules, the order cannot be specified. It can only be specified for existing rules.
workload_rule_type String Supported value: search_filter. You must specify this parameter to enable or disable an admission rule.

Returned values
None


Example request and response

XML Request 

curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/rules -d name=ruleTest2 -d predicate="(role=user AND runtime>5m)" -d action=abort

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-rules</title>
  <id>https://localhost:8089/services/workloads/rules</id>
  <updated>2018-08-29T13:29:09-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/rules/_new" rel="create"/>
  <link href="/services/workloads/rules/_reload" rel="_reload"/>
  <link href="/services/workloads/rules/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
<entry>
    <title>ruleTest2</title>
    <id>https://qa-ubuntu-022:8089/servicesNS/nobody/search/workloads/rules/ruleTest2</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/rules/ruleTest2" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/rules/ruleTest2" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/rules/ruleTest2/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/rules/ruleTest2" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/rules/ruleTest2" rel="remove"/>
    <link href="/servicesNS/nobody/search/workloads/rules/ruleTest2/move" rel="move"/>
    <link href="/servicesNS/nobody/search/workloads/rules/ruleTest2/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="action">abort</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="order">4</s:key>
        <s:key name="predicate">(role=user AND runtime>5m)</s:key>
        <s:key name="workload_pool"></s:key>
      </s:dict>
    </content>
  </entry>
</feed>

DELETE

Delete workload rules and admission rules.


Request parameters

Name Type Description
workload_rule_type String Specifies the rule to delete is an admission rule. Supported value:

search_filter.

Returned values
None


Example request and response

XML Request 

curl -k -u admin:pass -X DELETE https://localhost:8089/services/workloads/rules/rule_name

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-rules</title>
  <id>https://localhost:8089/services/workloads/rules</id>
  <updated>2018-08-29T13:29:47-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/rules/_new" rel="create"/>
  <link href="/services/workloads/rules/_reload" rel="_reload"/>
  <link href="/services/workloads/rules/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

workloads/config/enable

https://<host>:<mPort>/services/workloads/config/enable

Enable workload management.


Authentication and Authorization
Requires the edit_workload_pools capability.


POST

Enable workload management


Request parameters
None

Returned values
None


Example request and response

XML Request 

curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/config/enable

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-config</title>
  <id>https://localhost:8089/services/workloads/config</id>
  <updated>2018-08-29T13:32:26-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/config/_reload" rel="_reload"/>
  <link href="/services/workloads/config/_acl" rel="_acl"/>
  <link href="/services/workloads/config/disable" rel="disable"/>
  <link href="/services/workloads/config/enable" rel="enable"/>
  <link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
  <link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

workloads/config/disable

https://<host>:<mPort>/services/workloads/config/disable

Endpoint to disable workload management.


Authentication and Authorization
Requires the edit_workload_pools capability.


POST

Disable workload management


Request parameters
None

Returned values
None


Example request and response

XML Request 

curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/config/disable

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-config</title>
  <id>https://localhost:8089/services/workloads/config</id>
  <updated>2018-08-29T13:33:55-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/config/_reload" rel="_reload"/>
  <link href="/services/workloads/config/_acl" rel="_acl"/>
  <link href="/services/workloads/config/disable" rel="disable"/>
  <link href="/services/workloads/config/enable" rel="enable"/>
  <link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
  <link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

workloads/config/get-base-dirname

https://<host>:<mPort>/services/workloads/config/get-base-dirname

Get the name of the splunk parent cgroup.


Authentication and Authorization
Requires the edit_workload_pools capability.


GET

Get the name of the splunk parent cgroup.


Request parameters
None

Returned values

Name Type Description
workload_pool_base_dir_name String Specifies the parent level cgroup for splunk.

This setting applies only to systems running non-systemd setups. With systemd, this setting is ignored.

Example request and response

XML Request 

curl -k -u admin:pass https://localhost:8089/services/workloads/config/get-base-dirname

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-config</title>
  <id>https://localhost:8089/services/workloads/config</id>
  <updated>2018-08-29T14:49:48-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/config/_reload" rel="_reload"/>
  <link href="/services/workloads/config/_acl" rel="_acl"/>
  <link href="/services/workloads/config/disable" rel="disable"/>
  <link href="/services/workloads/config/enable" rel="enable"/>
  <link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
  <link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>workload-pool-base-path</title>
    <id>https://localhost:8089/services/workloads/config/workload-pool-base-path</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/services/workloads/config/workload-pool-base-path" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/workloads/config/workload-pool-base-path" rel="list"/>
    <link href="/services/workloads/config/workload-pool-base-path/_reload" rel="_reload"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>analyst</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="workload_pool_base_dir_name">splunk</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

workloads/config/preflight-checks

https://<host>:<mPort>/services/workloads/config/preflight-checks

Run Linux preflight checks for workload management.


Authentication and Authorization
Requires the list_workload_pools and edit_workload_pools capabilities.


GET

Run Linux preflight checks for workload management.


Request parameters
None

Returned values

Example request and response

XML Request 

curl -k -u admin:pass https://localhost:8089/services/workloads/config/preflight-checks

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-config</title>
  <id>https://localhost:8089/services/workloads/config</id>
  <updated>2018-11-30T14:38:15-08:00</updated>
  <generator build="611919ba3f87bb18f54b0df1b03fd86a273309c2" version="20181121"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/config/_reload" rel="_reload"/>
  <link href="/services/workloads/config/_acl" rel="_acl"/>
  <link href="/services/workloads/config/disable" rel="disable"/>
  <link href="/services/workloads/config/enable" rel="enable"/>
  <link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
  <link href="/services/workloads/config/preflight-checks" rel="preflight-checks"/>
  <link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>workload-management-preflight-checks</title>
    <id>https://qa-centos7x64-132:8089/services/workloads/config/workload-management-preflight-checks</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/services/workloads/config/workload-management-preflight-checks" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/workloads/config/workload-management-preflight-checks" rel="list"/>
    <link href="/services/workloads/config/workload-management-preflight-checks/_reload" rel="_reload"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="cgroup_version">
          <s:dict>
            <s:key name="mitigation">Cgroup version must be version 1.</s:key>
            <s:key name="preflight_check_status">1</s:key>
            <s:key name="title">Cgroup Version</s:key>
          </s:dict>
        </s:key>
        <s:key name="cpu_splunk_base_dir_permission">
          <s:dict>
            <s:key name="mitigation">CPU Splunk base directory Splunkd.service requires read and write permissions.</s:key>
            <s:key name="preflight_check_status">1</s:key>
            <s:key name="title">CPU Splunk base directory permissions</s:key>
          </s:dict>
        </s:key>
        <s:key name="cpu_splunk_base_dir_present">
          <s:dict>
            <s:key name="mitigation">CPU Splunk base directory Splunkd.service is missing.</s:key>
            <s:key name="preflight_check_status">1</s:key>
            <s:key name="title">CPU Splunk base directory present</s:key>
          </s:dict>
        </s:key>
        <s:key name="delegate_set">
          <s:dict>
            <s:key name="mitigation">The 'Delegate' property in the unit file must be set to 'true'. Restart Splunk then rerun preflight checks.</s:key>
            <s:key name="preflight_check_status">1</s:key>
            <s:key name="title">Delegate property set to true</s:key>
          </s:dict>
        </s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="general">
          <s:dict>
            <s:key name="preflight_checks_status">1</s:key>
            <s:key name="systemd_present">1</s:key>
          </s:dict>
        </s:key>
        <s:key name="launched_under_systemd">
          <s:dict>
            <s:key name="mitigation">In the unit file, the 'Restart' property must be set to 'always'. The 'ExecStart' property must include '_internal_launch_under_systemd'. Make sure the up-to-date unit file is loaded.</s:key>
            <s:key name="preflight_check_status">1</s:key>
            <s:key name="title">Splunk launched under systemd</s:key>
          </s:dict>
        </s:key>
        <s:key name="memory_splunk_base_dir_permission">
          <s:dict>
            <s:key name="mitigation">Memory Splunk base directory Splunkd.service requires read and write permissions.</s:key>
            <s:key name="preflight_check_status">1</s:key>
            <s:key name="title">Memory Splunk base directory permissions</s:key>
          </s:dict>
        </s:key>
        <s:key name="memory_splunk_base_dir_present">
          <s:dict>
            <s:key name="mitigation">Memory Splunk base directory Splunkd.service is missing.</s:key>
            <s:key name="preflight_check_status">1</s:key>
            <s:key name="title">Memory Splunk base directory present</s:key>
          </s:dict>
        </s:key>
        <s:key name="platform_type">
          <s:dict>
            <s:key name="mitigation">Operating system must be Linux.</s:key>
            <s:key name="preflight_check_status">1</s:key>
            <s:key name="title">Operating System</s:key>
          </s:dict>
        </s:key>
        <s:key name="unit_file_present">
          <s:dict>
            <s:key name="mitigation">Unit file Splunkd.service is missing. Restart Splunk then rerun preflight checks.</s:key>
            <s:key name="preflight_check_status">1</s:key>
            <s:key name="title">Unit file present</s:key>
          </s:dict>
        </s:key>
      </s:dict>
    </content>
  </entry>
</feed>

workloads/config/set-base-dirname

https://<host>:<mPort>/services/workloads/config/set-base-dirname

Set the name of the splunk parent cgroup.


Authentication and Authorization
Requires the edit_workload_pools capability.


POST

Set the name of the splunk parent cgroup.


Request parameters

Name Type Description
workload_pool_base_dir_name String Specifies the parent level cgroup for splunk.

This setting applies only to systems running non-systemd setups. With systemd, this setting is ignored.

Returned values
None


Example request and response

XML Request 

curl -k -u admin:pass https://localhost:8089/services/workloads/config/set-base-dirname -d "workload_pool_base_dir_name=splunkbase"

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-config</title>
  <id>https://localhost:8089/services/workloads/config</id>
  <updated>2018-08-29T14:54:31-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/config/_reload" rel="_reload"/>
  <link href="/services/workloads/config/_acl" rel="_acl"/>
  <link href="/services/workloads/config/disable" rel="disable"/>
  <link href="/services/workloads/config/enable" rel="enable"/>
  <link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
  <link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
</feed>

workloads/policy/search_admission_control

https://<host>:<mPort>/services/search/workloads/policy/search_admission_control

Enable or disable admission rules.


Authentication and Authorization

  • GET requires the list_workload_policy capability.
  • POST requires the edit_workload_policy capability.


GET

List the enabled status of admission rules.


Request parameters
None

Returned values

Name Type Description
admission_rules_enabled Boolean Specifies the enabled status of admission rules. 0 (disabled) or 1 (enabled).

Example request and response

XML Request 

curl -k -u admin:pass https://localhost:8089/services/workloads/policy/search_admission_control

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-policy</title>
  <id>https://qa-ubuntu-022:8089/services/workloads/policy</id>
  <updated>2020-10-10T16:55:22-07:00</updated>
  <generator build="4cd34d9fdb3b" version="8.1.2008"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/policy/_reload" rel="_reload"/>
  <link href="/services/workloads/policy/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>search_admission_control</title>
    <id>https://qa-ubuntu-022:8089/servicesNS/nobody/search/workloads/policy/search_admission_control</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="admission_rules_enabled">0</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
        <s:key name="eai:attributes">
          <s:dict>
            <s:key name="optionalFields">
              <s:list>
                <s:item>admission_rules_enabled</s:item>
              </s:list>
            </s:key>
            <s:key name="requiredFields">
              <s:list/>
            </s:key>
            <s:key name="wildcardFields">
              <s:list/>
            </s:key>
          </s:dict>
        </s:key>
      </s:dict>
    </content>
  </entry>
</feed>

POST

Enable or disable admission rules.


Request parameters

Name Type Description
admission_rules_enabled Boolean Enable or disable admission rules. 0 (disabled) or 1 (enabled).

Returned values
None


Example request and response

XML Request 

curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/policy/search_admission_control -d admission_rules_enabled=1"

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-policy</title>
  <id>https://qa-ubuntu-022:8089/services/workloads/policy</id>
  <updated>2020-10-10T17:00:58-07:00</updated>
  <generator build="4cd34d9fdb3b" version="8.1.2008"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/policy/_reload" rel="_reload"/>
  <link href="/services/workloads/policy/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>search_admission_control</title>
    <id>https://qa-ubuntu-022:8089/servicesNS/nobody/search/workloads/policy/search_admission_control</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control" rel="list"/>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control" rel="edit"/>
    <link href="/servicesNS/nobody/search/workloads/policy/search_admission_control/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="admission_rules_enabled">1</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app">search</s:key>
            <s:key name="can_change_perms">1</s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_share_app">1</s:key>
            <s:key name="can_share_global">1</s:key>
            <s:key name="can_share_user">0</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">1</s:key>
            <s:key name="owner">nobody</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">1</s:key>
            <s:key name="sharing">app</s:key>
          </s:dict>
        </s:key>
      </s:dict>
    </content>
  </entry>
</feed>

workloads/status

https://<host>:<mPort>/services/workloads/status

Get information on the current status of workload management.


Authentication and Authorization
Requires the list_workload_pools capability.


GET

Get information on the current status of workload management.


Request parameters

Name Type Description
advanced Boolean advanced=1 returns dispatch time for each process running in each search pool.

Returned values

General information:

Name Type Description
default_pool String Specifies the workload pool marked as the default pool.
ingest_pool Number Specifies the workload pool marked as the ingest pool.
error_message String Displays the last error message observed while trying to enable workload management. This message is reset to empty on each successful enablement of workload management.
enabled Boolean Specifies whether or not workload management is enabled.
isSupported Boolean Specifies whether or not workload management is supported on this machine.
os_build String Specifies the operating system build information.
os_extended_name String Specifies the extended name of the underlying operating system.
os_name String Specifies the name of the underlying operating system.
os_version String Specifies the operating system version.

Workload pools:

Name Type Description
cpu_weight' Number Specifies the fraction of the cpu assigned to this pool as a ratio of the total of cpu_weight across all pools. This fraction is then applied to the cpu shares assigned to the parent group.
mem_weight Number Specifies the fraction of the memory assigned to this pool as a ratio of the total of mem_weight across all pools. This fraction is then applied to the memory limits assigned to the parent group.

Workload rules:

Name Type Description
predicate String Specifies the predicate condition that must match to access a workload pool. This must be of the format "app=<value>" or "role=<value". For example, app=itsi, role=admin. No other predicate formats are supported.
workload_pool String Specifies the workload pool to associate with the workload rule.
order Number Specifies the evaluation order for this workload rule amongst a group of workload rules.

Example request and response

XML Request 

curl -k -u admin:pass https://localhost:8089/services/workloads/status

XML Response 

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>workload-status</title>
  <id>https://localhost:8089/services/workloads/status</id>
  <updated>2018-08-29T13:53:48-07:00</updated>
  <generator build="fc353da83307" version="7.2.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/workloads/status/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>workload-management-status</title>
    <id>https://localhost:8089/services/workloads/status/workload-management-status</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/services/workloads/status/workload-management-status" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/workloads/status/workload-management-status" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>analyst</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list/>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="general">
          <s:dict>
            <s:key name="default_pool">default_search_pool</s:key>
            <s:key name="enabled">1</s:key>
            <s:key name="error_message"></s:key>
            <s:key name="ingest_pool">default_ingest_pool</s:key>
            <s:key name="isSupported">1</s:key>
            <s:key name="os_build">#1 SMP Wed Oct 19 11:24:13 EDT 2016</s:key>
            <s:key name="os_extended_name">Linux</s:key>
            <s:key name="os_name">Linux</s:key>
            <s:key name="os_version">3.10.0-514.el7.x86_64</s:key>
          </s:dict>
        </s:key>
        <s:key name="workload-pools">
          <s:dict>
            <s:key name="default_ingest_pool">
              <s:dict>
                <s:key name="cpu_group">/sys/fs/cgroup/cpu/system.slice/Splunkd.service/default_ingest_pool</s:key>
                <s:key name="cpu_weight">25</s:key>
                <s:key name="mem_group">/sys/fs/cgroup/memory/system.slice/Splunkd.service/default_ingest_pool</s:key>
                <s:key name="mem_weight">25</s:key>
              </s:dict>
            </s:key>
            <s:key name="default_search_pool">
              <s:dict>
                <s:key name="cpu_group">/sys/fs/cgroup/cpu/system.slice/Splunkd.service/default_search_pool</s:key>
                <s:key name="cpu_weight">25</s:key>
                <s:key name="mem_group">/sys/fs/cgroup/memory/system.slice/Splunkd.service/default_search_pool</s:key>
                <s:key name="mem_weight">25</s:key>
              </s:dict>
            </s:key>
            <s:key name="pool_2">
              <s:dict>
                <s:key name="cpu_group">/sys/fs/cgroup/cpu/system.slice/Splunkd.service/pool_2</s:key>
                <s:key name="cpu_weight">20</s:key>
                <s:key name="mem_group">/sys/fs/cgroup/memory/system.slice/Splunkd.service/pool_2</s:key>
                <s:key name="mem_weight">20</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="workload-rules">
          <s:dict>
            <s:key name="rule_3">
              <s:dict>
                <s:key name="order">1</s:key>
                <s:key name="predicate">role=analyst</s:key>
                <s:key name="workload_pool">pool_2</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
      </s:dict>
    </content>
  </entry>
</feed>
Last modified on 12 October, 2021
System endpoint descriptions  

This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2, 9.4.0

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters