Monitor workload management
There are two ways to monitor workload management in Splunk Enterprise:
- Use the monitoring console. See Monitor workload management using the monitoring console.
- Use the
splunkdhealth report. See Monitor workload management using the splunkd health report.
Monitor workload management using the monitoring console
The monitoring console provides a set of workload management dashboards that give you insight into various aspects of your workload management deployment. You can use these dashboards to view configuration information, track CPU and memory resource usage, and monitor activity details for both single instance and distributed deployments.
To view workload management dashboards:
- In Splunk Web, click Settings > Monitoring Console.
- Click Resource Usage > Workload Management.
- Select from the following dashboard pages:
- Workload Management Overview
- Workload Management Activity: Instance/Deployment
- Workload Management Monitoring: Instance/Distributed
Workload Management Overview
The Workload management overview page includes these dashboards:
- Workload management status and workload pool configuration
- CPU and memory usage
Workload management status and workload pool configuration
These dashboards shows information about your deployment, including whether workload management is supported and enabled on individual Linux instances. They also displays error messages and workload pool configuration details.
CPU and memory usage
The CPU and memory usage dashboards show resource consumption on a per pool basis. You can use these dashboards to monitor the total amount of resources that search processes are consuming within individual pools.
Monitoring workload pool resource consumption can help you provision resources efficiently and help you avoid assigning too many searches to a pool, which can degrade search performance.
Memory usage is an estimate only, based on simple addition of the amount of memory used by each process in a pool. Memory shared between processes can be counted repeatedly, which can produce an overestimate of memory usage in a workload pool.
Workload Management Activity: Instance
These dashboards let you monitor workload management activity on a per instance basis.
Use the snapshot view to monitor current resource usage across all workload pools.
Use the historical view to monitor cpu and memory usage of individual workload pools over a selected time range.
The historical view also displays the top 10 memory-consuming searches in a pool. This dashboard can help you identify searches that are consuming large amounts of CPU and memory resources.
Workload Management Activity: Deployment
These dashboards let you monitor workload management activity across a distributed deployment.
Use the snapshot view to monitor the current status of workload pools across multiple instances.
Use the historical view to monitor cpu and memory usage of individual workload pools over a selected time range across your distributed deployment.
Monitor workload management using the splunkd health report
splunkd health report lets you view the status of Splunk Enterprise features from the output of a REST API endpoint. Individual features report their health status through a tree structure that provides a continuous, real-time view of the health of your deployment.
splunkd health report supports these workload management features:
- System check: Checks whether the underlying Linux operating system is set up properly for workload management.
- Configuration checks: Checks whether the workload management configuration, including pools and rules, is valid.
You can use the health report to monitor the health of workload management features and investigate health status changes that might indicate a problem with your underlying Linux system or workload management configuration.
View workload management status
You can view the status of workload management features in the
splunkd health report in Splunk Web. For instructions on how to view the health report and investigate issues, see Investigate feature health status changes in Monitoring Splunk Enterprise.
You can also access workload management feature health information programmatically from the
server/health/splunkd endpoint. See Query the server/health/splunkd endpoint.
splunkd health report checks workload management feature status only when workload management is set to enabled in Splunk Enterprise.
The splunkd health report shows workload management health status on the local instance on which you are monitoring only.
For more information on the splunkd health report, see About proactive Splunk component monitoring in Monitoring Splunk Enterprise.
Manually assign searches to workload pools
Upgrade workload management
This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2