Splunk® Enterprise

Workload Management

Download manual as PDF

Download topic as PDF

Monitor workload management

There are two ways to monitor workload management in Splunk Enterprise:

Monitor workload management using the monitoring console

The monitoring console provides a set of workload management dashboards that give you insight into various aspects of your workload management deployment. You can use these dashboards to view configuration information, track CPU and memory resource usage, and monitor activity details for both single instance and distributed deployments.

To view workload management dashboards:

  1. In Splunk Web, click Settings > Monitoring Console.
  2. Click Resource Usage > Workload Management.
  3. Select from the following dashboard pages:
    • Workload Management Overview
    • Workload Management Activity: Instance/Deployment
    • Workload Management Monitoring: Instance/Distributed

Workload Management Overview

The Workload management overview page includes these dashboards:

  • Workload management status and workload pool configuration
  • CPU and memory usage

Workload management status and workload pool configuration

These dashboards shows information about your deployment, including whether workload management is supported and enabled on individual Linux instances. They also displays error messages and workload pool configuration details.

WLM MC dashboard.png

CPU and memory usage

The CPU and memory usage dashboards show resource consumption on a per pool basis. You can use these dashboards to monitor the total amount of resources that search processes are consuming within individual pools.

Monitoring workload pool resource consumption can help you provision resources efficiently and help you avoid assigning too many searches to a pool, which can degrade search performance.

Memory usage is an estimate only, based on simple addition of the amount of memory used by each process in a pool. Memory shared between processes can be counted repeatedly, which can produce an overestimate of memory usage in a workload pool.

Mc wlm cpu usage.png

Workload Management Activity: Instance

These dashboards let you monitor workload management activity on a per instance basis.

Use the snapshot view to monitor current resource usage across all workload pools.

WLM mc activity snapshot.png

Use the historical view to monitor cpu and memory usage of individual workload pools over a selected time range.

The historical view also displays the top 10 memory-consuming searches in a pool. This dashboard can help you identify searches that are consuming large amounts of CPU and memory resources.

WLM mc instance historical.png

Workload Management Activity: Deployment

These dashboards let you monitor workload management activity across a distributed deployment.

Use the snapshot view to monitor the current status of workload pools across multiple instances.

WLM mc deployment snapshot.png

Use the historical view to monitor cpu and memory usage of individual workload pools over a selected time range across your distributed deployment.

WLM mc deployment historical.png

Monitor workload management using the splunkd health report

The splunkd health report lets you view the status of Splunk Enterprise features from the output of a REST API endpoint. Individual features report their health status through a tree structure that provides a continuous, real-time view of the health of your deployment.

The splunkd health report supports these workload management features:

  • System check: Checks whether the underlying Linux operating system is set up properly for workload management.
  • Configuration checks: Checks whether the workload management configuration, including pools and rules, is valid.

You can use the health report to monitor the health of workload management features and investigate health status changes that might indicate a problem with your underlying Linux system or workload management configuration.

Wlm health report feature.png

View workload management status

You can view the status of workload management features in the splunkd health report in Splunk Web. For instructions on how to view the health report and investigate issues, see Investigate feature health status changes in Monitoring Splunk Enterprise.

You can also access workload management feature health information programmatically from the server/health/splunkd endpoint. See Query the server/health/splunkd endpoint.

The splunkd health report checks workload management feature status only when workload management is set to enabled in Splunk Enterprise.

The splunkd health report shows workload management health status on the local instance on which you are monitoring only.

For more information on the splunkd health report, see About proactive Splunk component monitoring in Monitoring Splunk Enterprise.

Last modified on 15 January, 2020
Manually assign searches to workload pools
Upgrade workload management

This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters