Splunk® Enterprise

Workload Management

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Configure workload management on distributed deployments

You can use workload management to allocate resources in both non-clustered and clustered distributed search environments.

Configure workload management on non-clustered indexers

To configure workload management on non-clustered indexers, you must first configure and enable workload management on the search head, then copy the enabled workload_pools.conf file to all indexers.

You do not need to copy workload_rules.conf to indexers. Its functionality applies to search heads only.

To configure and enable workload management on non-clustered indexers:

  1. Configure and enable workload management on the search head. See Configure workload management.
  2. Copy the enabled workload_pools.conf file to all indexers.
  3. Reload workload_pools.conf on each indexer. For example:
    curl -k -u admin:pass https://<host>:<mPort>/services/configs/services/workloads/pools/_reload
    

    Reloading workload_pools.conf enables workload management.

Configure workload management on an indexer cluster

To configure workload management on an indexer cluster, you must first configure and enable workload management on the search head, then use the configuration bundle method to push workload_pools.conf from the cluster master to peer nodes.

You do not need to push workload_rules.conf to the indexer cluster. Its functionality applies to search heads only.

To configure and enable workload management on an indexer cluster:

  1. Configure and enable workload management on the search head. See Configure workload management.
  2. Copy the enabled workload_pools.conf file from the search head to the configuration bundle on the cluster master.
  3. Distribute the configuration bundle to all peer nodes. For detailed instructions, see Distribute the configuration bundle.
    After the bundle push, peer nodes automatically reload the enabled configuration file, which enables workload management.

Configure workload management on a search head cluster

To configure workload management on a search head cluster, use configuration replication to replicate workload management configuration files to all search head cluster members.

Both workload_pools.conf and workload_rules.conf are required on all search heads.

  1. On any cluster member, in Splunk Web, click Settings > Workload Management.
  2. Configure and enable workload management. See Configure workload management.
    The cluster automatically replicates the configuration to all cluster members. This triggers a reload of the enabled configuration files on each cluster member, which enables workload management.

For more information on configuration replication, see Configuration updates the cluster replicates.

You can use the deployer to push workload management configuration files to search head cluster members. However, you cannot use both the deployer bundle push method and the configuration replication method to update cluster configurations. You must choose one method and use only that method. Using both methods can cause workload management to fail. For more information, see Use the deployer to distribute apps and configuration updates.

PREVIOUS
Configure workload management
  NEXT
Set access controls for workload managment

This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters