Splunk Enterprise version 8.0 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise.
For documentation on the most recent version, go to the latest release.
Workload management endpoint descriptions
Manage system resources for search and indexing processes.
- Create workload pools (CPU and memory resource groups).
- Create workload rules to grant access and prioritize workload pools.
- Assign scheduled and ad hoc searches to workload pools.
For more information, see About workload management in the Workload Management manual.
Usage details
Review ACL information for an endpoint
To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.
Authentication and Authorization
Username and password authentication is required for access to endpoints and REST operations.
Splunk users must have role and/or capability-based authorization to use REST endpoints. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls and click Users. To determine the capabilities assigned to a role, select Settings > Access controls and click Roles.
App and user context
Typically, knowledge objects, such as saved searches or event types, have an app/user context that is the namespace. For more information about specifying a namespace, see Namespace in the REST API User Manual.
Splunk Cloud limitations
If you have a managed Splunk Cloud deployment with search head clustering and index clustering, the REST API supports access to the search head only. You can use the REST API to interact with the search head in your deployment. Using the REST API to access any other cluster member nodes is not supported. For example, index cluster management endpoints are not applicable to Splunk Cloud deployments.
Authorized users can access and configure other cluster members, including indexer, cluster master, and license master nodes, in the Splunk Cloud manager user interface.
workloads/categories
https://<host>:<mPort>/services/workloads/categories
List and edit workload categories.
There are three predefined categories: search, ingest, and misc. You cannot create or delete categories. You can only edit and list them.
Authentication and Authorization
- GET requires the
list_workload_poolscapability. - POST requires the
edit_workload_poolscapability.
GET
List information about workload categories.
Request parameters
None
Returned values
| Name | Type | Description |
|---|---|---|
| cpu_weight | Number | Specifies the fraction of the cpu assigned to this category as a ratio of the total of cpu_weight across all categories. This fraction is then applied to the cpu shares assigned to the parent group. The value must be > 0 and <= 100. |
| mem_weight | Number | Specifies the percentage of memory assigned to this category as a percent of the parent group. The total amount of memory limit for this category is a percentage of the value assigned to the parent group. The value must be > 0 and <= 100. |
Example request and response
XML Request
curl -k -u admin:pass https://localhost:8089/services/workloads/categories/search
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-categories</title>
<id>https://qa-ubuntu-022:8089/services/workloads/categories</id>
<updated>2019-03-20T14:11:59-07:00</updated>
<generator build="8c85c1fbcc8c" version="7.3.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/categories/_reload" rel="_reload"/>
<link href="/services/workloads/categories/_acl" rel="_acl"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>search</title>
<id>https://qa-ubuntu-022:8089/servicesNS/nobody/system/workloads/categories/search</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/servicesNS/nobody/system/workloads/categories/search" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/system/workloads/categories/search" rel="list"/>
<link href="/servicesNS/nobody/system/workloads/categories/search/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/system/workloads/categories/search" rel="edit"/>
<link href="/servicesNS/nobody/system/workloads/categories/search/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="cpu_allocated_percent">70.00</s:key>
<s:key name="cpu_weight">70</s:key>
<s:key name="cpu_weight_sum">100</s:key>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">system</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">system</s:key>
</s:dict>
</s:key>
<s:key name="eai:attributes">
<s:dict>
<s:key name="optionalFields">
<s:list>
<s:item>cpu_weight</s:item>
<s:item>mem_weight</s:item>
</s:list>
</s:key>
<s:key name="requiredFields">
<s:list/>
</s:key>
<s:key name="wildcardFields">
<s:list/>
</s:key>
</s:dict>
</s:key>
<s:key name="mem_allocated_percent">60.00</s:key>
<s:key name="mem_weight">60</s:key>
</s:dict>
</content>
</entry>
</feed>
POST
Edit workload categories.
Request parameters
| Name | Type | Description |
|---|---|---|
| cpu_weight | Number | Specifies the fraction of the cpu assigned to this category as a ratio of the total of cpu_weight across all categories. This fraction is then applied to the cpu shares assigned to the parent group. The value must be > 0 and <= 100 |
| mem_weight | Number | Specifies the percentage of memory assigned to this pool as a percent of the parent group. The total amount of memory limit for this pool is a percentage of the value assigned to the parent group. The value must be > 0 and <= 100. |
Returned values
None
Example request and response
XML Request
curl -k -u admin:pass https://localhost:8089/services/workloads/categories/search -d cpu_weight=40 -d mem_weight=50
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-categories</title>
<id>https://qa-ubuntu-022:8089/services/workloads/categories</id>
<updated>2019-03-20T14:21:44-07:00</updated>
<generator build="8c85c1fbcc8c" version="7.3.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/categories/_reload" rel="_reload"/>
<link href="/services/workloads/categories/_acl" rel="_acl"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>search</title>
<id>https://localhost:8089/servicesNS/nobody/search/workloads/categories/search</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/servicesNS/nobody/search/workloads/categories/search" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/search/workloads/categories/search" rel="list"/>
<link href="/servicesNS/nobody/search/workloads/categories/search/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/workloads/categories/search" rel="edit"/>
<link href="/servicesNS/nobody/search/workloads/categories/search/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="cpu_allocated_percent">57.14</s:key>
<s:key name="cpu_weight">40</s:key>
<s:key name="cpu_weight_sum">70</s:key>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">search</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">app</s:key>
</s:dict>
</s:key>
<s:key name="mem_allocated_percent">60.00</s:key>
<s:key name="mem_weight">60</s:key>
</s:dict>
</content>
</entry>
</feed>
workloads/pools
https://<host>:<mPort>/services/workloads/pools
Perform CRUD operations on workload pools.
Authentication and Authorization
- GET requires the
list_workload_poolscapability. - POST and DELETE require the
edit_workload_poolscapability.
GET
List information about workload pools.
Request parameters
None
Returned values
| Name | Type | Description |
|---|---|---|
| cpu_weight | Number | Specifies the fraction of the cpu assigned to this pool as a ratio of the total of cpu_weight across all pools in a category. This fraction is then applied to the cpu shares assigned to the category. |
| mem_weight | Number | Specifies the percentage of the memory assigned to this pool as a percent of the category. The total amount of memory limit for this pool is a percentage of the value assigned to the category. |
| category | string | Specifies the category in which a poll is created. Can be either "search", "ingest", or "misc". |
| default_category_pool | Boolean | Specifies the workload pool marked as default pool for its category. This property is defined per workload_pool stanza. Default is 0. |
| default_pool | Boolean | Specifies a workload pool defined in the search category as the default pool for the search category.
deprecated parameter retained for backwards compatibility with 7.2.x |
| ingest_pool | Boolean | Specifies a workload-pool defined in the ingest category as the default pool for the ingest category.
deprecated parameter retained for backwards compatibility with 7.2.x |
Example request and response
XML Request
curl -k -u admin:pass https://localhost:8089/services/workloads/pools/search_pool_1
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-pools</title>
<id>https://qa-ubuntu-022:8089/services/workloads/pools</id>
<updated>2019-03-21T11:58:38-07:00</updated>
<generator build="8c85c1fbcc8c" version="7.3.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/pools/_new" rel="create"/>
<link href="/services/workloads/pools/_reload" rel="_reload"/>
<link href="/services/workloads/pools/_acl" rel="_acl"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>search_pool_1</title>
<id>https://qa-ubuntu-022:8089/servicesNS/nobody/search/workloads/pools/search_pool_1</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_1" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_1" rel="list"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_1/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_1" rel="edit"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_1" rel="remove"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_1/move" rel="move"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_1/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="category">search</s:key>
<s:key name="cpu_allocated_percent">28.57</s:key>
<s:key name="cpu_shares">512</s:key>
<s:key name="cpu_weight">20</s:key>
<s:key name="default_category_pool">1</s:key>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">search</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">app</s:key>
</s:dict>
</s:key>
<s:key name="eai:attributes">
<s:dict>
<s:key name="optionalFields">
<s:list>
<s:item>cpu_weight</s:item>
<s:item>default_category_pool</s:item>
<s:item>default_pool</s:item>
<s:item>ingest_pool</s:item>
<s:item>mem_weight</s:item>
</s:list>
</s:key>
<s:key name="requiredFields">
<s:list/>
</s:key>
<s:key name="wildcardFields">
<s:list/>
</s:key>
</s:dict>
</s:key>
<s:key name="mem_allocated_percent">12.00</s:key>
<s:key name="mem_limit">12884901888</s:key>
<s:key name="mem_weight">20</s:key>
</s:dict>
</content>
</entry>
</feed>
POST
Create and configure workload pools.
Request parameters
| Name | Type | Description |
|---|---|---|
| cpu_weight | Number | Specifies the fraction of the cpu assigned to this pool as a ratio of the total of cpu_weight across all pools. This fraction is then applied to the cpu shares assigned to the parent group. |
| mem_weight | Number | Specifies the fraction of the memory assigned to this pool as a ratio of the total of mem_weight across all pools. This fraction is then applied to the memory limits assigned to the parent group. |
| category | string | Specifies the category in which a poll is created. Can be either "search", "ingest", or "misc". |
| default_category_pool | Boolean | Specifies the workload pool marked as default pool for its category. This property is defined per workload_pool stanza. Default is 0. |
| default_pool | Boolean | Specifies a workload pool defined in the search category as the default pool for the search category.
deprecated parameter retained for backwards compatibility with 7.2.x |
| ingest_pool | Boolean | Specifies a workload-pool defined in the ingest category as the default pool for the ingest category.
deprecated parameter retained for backwards compatibility with 7.2.x |
Returned values
None
Example request and response
XML Request
curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/pools -d name=search_pool_3 -d category=search -d cpu_weight=40 -d mem_weight=60 -d default_category_pool=1
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-pools</title>
<id>https://qa-ubuntu-022:8089/services/workloads/pools</id>
<updated>2019-03-21T12:05:12-07:00</updated>
<generator build="8c85c1fbcc8c" version="7.3.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/pools/_new" rel="create"/>
<link href="/services/workloads/pools/_reload" rel="_reload"/>
<link href="/services/workloads/pools/_acl" rel="_acl"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>search_pool_3</title>
<id>https://qa-ubuntu-022:8089/servicesNS/nobody/search/workloads/pools/search_pool_3</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_3" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_3" rel="list"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_3/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_3" rel="edit"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_3" rel="remove"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_3/move" rel="move"/>
<link href="/servicesNS/nobody/search/workloads/pools/search_pool_3/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="category">search</s:key>
<s:key name="cpu_allocated_percent">28.57</s:key>
<s:key name="cpu_shares">0</s:key>
<s:key name="cpu_weight">40</s:key>
<s:key name="default_category_pool">1</s:key>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">search</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">app</s:key>
</s:dict>
</s:key>
<s:key name="mem_allocated_percent">36.00</s:key>
<s:key name="mem_limit">0</s:key>
<s:key name="mem_weight">60</s:key>
</s:dict>
</content>
</entry>
</feed>
workloads/rules
https://<host>:<mPort>/services/workloads/rules
Perform CRUD operations on workload rules.
Authentication and Authorization
- GET requires the
list_workload_rulescapability. - POST and DELETE require the
edit_workload_rulescapability.
GET
List information about workload rules.
Request parameters
None
Returned values
| Name | Type | Description |
|---|---|---|
| predicate | String | The predicate (condition) required to access the workload pool. |
| workload_pool | String | Specifies the workload pool associated with the workload rule. |
| order | Boolean | Specifies the evaluation order for this workload rule amongst a group of workload rules. |
Example request and response
XML Request
curl -k -u admin:pass https://localhost:8089/services/workloads/rules
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-rules</title>
<id>https://localhost:8089/services/workloads/rules</id>
<updated>2018-08-29T13:18:21-07:00</updated>
<generator build="fc353da83307" version="7.2.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/rules/_new" rel="create"/>
<link href="/services/workloads/rules/_reload" rel="_reload"/>
<link href="/services/workloads/rules/_acl" rel="_acl"/>
<opensearch:totalResults>3</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>rule_1</title>
<id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_1</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="list"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="edit"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="remove"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1/move" rel="move"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">search</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">app</s:key>
</s:dict>
</s:key>
<s:key name="order">3</s:key>
<s:key name="predicate">app=search</s:key>
<s:key name="workload_pool">default_search_pool</s:key>
</s:dict>
</content>
</entry>
<entry>
<title>rule_2</title>
<id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_2</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="list"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_2/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="edit"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_2" rel="remove"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_2/move" rel="move"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_2/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">search</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">app</s:key>
</s:dict>
</s:key>
<s:key name="order">1</s:key>
<s:key name="predicate">role=admin</s:key>
<s:key name="workload_pool">pool_1</s:key>
</s:dict>
</content>
</entry>
<entry>
<title>rule_3</title>
<id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_3</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="list"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_3/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="edit"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_3" rel="remove"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_3/move" rel="move"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_3/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">search</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">app</s:key>
</s:dict>
</s:key>
<s:key name="order">2</s:key>
<s:key name="predicate">role=analyst</s:key>
<s:key name="workload_pool">pool_2</s:key>
</s:dict>
</content>
</entry>
</feed>
POST
Create and configure a workload rule.
Request parameters
| Name | Type | Description |
|---|---|---|
| predicate | String | Specifies a predicate (condition) that must be true for a search to gain access to the workload pool. The syntax is <type>=<value>, with optional AND, OR, NOT, (). For example, app=search AND role=power maps all searches belonging to both the Search app and the power role to the designated workload pool.
|
| action | String | Specifies the action to take when a running search exceeds the specified runtime value. Supported actions are alert, move and abort.
|
| workload_pool | String | Specifies the workload pool associated with the workload rule. Specifies the destination workload pool for the move action.
|
| order | Number | Specifies the evaluation order for this workload rule amongst a group of workload rules. For newly created rules, the order cannot be specified. It can only be specified for existing rules. |
Returned values
None
Example request and response
XML Request
curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/rules/rule_1 -d predicate="app=splunk_instrumentation"
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-rules</title>
<id>https://localhost:8089/services/workloads/rules</id>
<updated>2018-08-29T13:29:09-07:00</updated>
<generator build="fc353da83307" version="7.2.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/rules/_new" rel="create"/>
<link href="/services/workloads/rules/_reload" rel="_reload"/>
<link href="/services/workloads/rules/_acl" rel="_acl"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>rule_1</title>
<id>https://localhost:8089/servicesNS/nobody/search/workloads/rules/rule_1</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="list"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="edit"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1" rel="remove"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1/move" rel="move"/>
<link href="/servicesNS/nobody/search/workloads/rules/rule_1/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="eai:acl">
<s:dict>
<s:key name="app">search</s:key>
<s:key name="can_change_perms">1</s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_share_app">1</s:key>
<s:key name="can_share_global">1</s:key>
<s:key name="can_share_user">0</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">1</s:key>
<s:key name="owner">nobody</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">1</s:key>
<s:key name="sharing">app</s:key>
</s:dict>
</s:key>
<s:key name="order">3</s:key>
<s:key name="predicate">app=splunk_instrumentation</s:key>
<s:key name="workload_pool">default_search_pool</s:key>
</s:dict>
</content>
</entry>
</feed>
DELETE
Delete workload rules.
Request parameters
None
Returned values
None
Example request and response
XML Request
curl -k -u admin:pass -X DELETE https://localhost:8089/services/workloads/rules/rule_1
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-rules</title>
<id>https://localhost:8089/services/workloads/rules</id>
<updated>2018-08-29T13:29:47-07:00</updated>
<generator build="fc353da83307" version="7.2.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/rules/_new" rel="create"/>
<link href="/services/workloads/rules/_reload" rel="_reload"/>
<link href="/services/workloads/rules/_acl" rel="_acl"/>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
</feed>
workloads/config/enable
https://<host>:<mPort>/services/workloads/config/enable
Enable workload management.
Authentication and Authorization
Requires the edit_workload_pools capability.
POST
Enable workload management
Request parameters
None
Returned values
None
Example request and response
XML Request
curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/config/enable
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-config</title>
<id>https://localhost:8089/services/workloads/config</id>
<updated>2018-08-29T13:32:26-07:00</updated>
<generator build="fc353da83307" version="7.2.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/config/_reload" rel="_reload"/>
<link href="/services/workloads/config/_acl" rel="_acl"/>
<link href="/services/workloads/config/disable" rel="disable"/>
<link href="/services/workloads/config/enable" rel="enable"/>
<link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
<link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
</feed>
workloads/config/disable
https://<host>:<mPort>/services/workloads/config/disable
Endpoint to disable workload management.
Authentication and Authorization
Requires the edit_workload_pools capability.
POST
Disable workload management
Request parameters
None
Returned values
None
Example request and response
XML Request
curl -k -u admin:pass -X POST https://localhost:8089/services/workloads/config/disable
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-config</title>
<id>https://localhost:8089/services/workloads/config</id>
<updated>2018-08-29T13:33:55-07:00</updated>
<generator build="fc353da83307" version="7.2.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/config/_reload" rel="_reload"/>
<link href="/services/workloads/config/_acl" rel="_acl"/>
<link href="/services/workloads/config/disable" rel="disable"/>
<link href="/services/workloads/config/enable" rel="enable"/>
<link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
<link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
</feed>
workloads/config/get-base-dirname
https://<host>:<mPort>/services/workloads/config/get-base-dirname
Get the name of the splunk parent cgroup.
Authentication and Authorization
Requires the edit_workload_pools capability.
GET
Get the name of the splunk parent cgroup.
Request parameters
None
Returned values
| Name | Type | Description |
|---|---|---|
| workload_pool_base_dir_name | String | Specifies the parent level cgroup for splunk. This setting applies only to systems running non-systemd setups. With systemd, this setting is ignored. |
Example request and response
XML Request
curl -k -u admin:pass https://localhost:8089/services/workloads/config/get-base-dirname
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-config</title>
<id>https://localhost:8089/services/workloads/config</id>
<updated>2018-08-29T14:49:48-07:00</updated>
<generator build="fc353da83307" version="7.2.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/config/_reload" rel="_reload"/>
<link href="/services/workloads/config/_acl" rel="_acl"/>
<link href="/services/workloads/config/disable" rel="disable"/>
<link href="/services/workloads/config/enable" rel="enable"/>
<link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
<link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>workload-pool-base-path</title>
<id>https://localhost:8089/services/workloads/config/workload-pool-base-path</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/services/workloads/config/workload-pool-base-path" rel="alternate"/>
<author>
<name>system</name>
</author>
<link href="/services/workloads/config/workload-pool-base-path" rel="list"/>
<link href="/services/workloads/config/workload-pool-base-path/_reload" rel="_reload"/>
<content type="text/xml">
<s:dict>
<s:key name="eai:acl">
<s:dict>
<s:key name="app"></s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">0</s:key>
<s:key name="owner">system</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>admin</s:item>
<s:item>analyst</s:item>
<s:item>splunk-system-role</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>admin</s:item>
<s:item>splunk-system-role</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">0</s:key>
<s:key name="sharing">system</s:key>
</s:dict>
</s:key>
<s:key name="workload_pool_base_dir_name">splunk</s:key>
</s:dict>
</content>
</entry>
</feed>
workloads/config/preflight-checks
https://<host>:<mPort>/services/workloads/config/preflight-checks
Run Linux preflight checks for workload management.
Authentication and Authorization
Requires the list_workload_pools and edit_workload_pools capabilities.
GET
Run Linux preflight checks for workload management.
Request parameters
None
Returned values
Example request and response
XML Request
curl -k -u admin:pass https://localhost:8089/services/workloads/config/preflight-checks
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-config</title>
<id>https://localhost:8089/services/workloads/config</id>
<updated>2018-11-30T14:38:15-08:00</updated>
<generator build="611919ba3f87bb18f54b0df1b03fd86a273309c2" version="20181121"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/config/_reload" rel="_reload"/>
<link href="/services/workloads/config/_acl" rel="_acl"/>
<link href="/services/workloads/config/disable" rel="disable"/>
<link href="/services/workloads/config/enable" rel="enable"/>
<link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
<link href="/services/workloads/config/preflight-checks" rel="preflight-checks"/>
<link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>workload-management-preflight-checks</title>
<id>https://qa-centos7x64-132:8089/services/workloads/config/workload-management-preflight-checks</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/services/workloads/config/workload-management-preflight-checks" rel="alternate"/>
<author>
<name>system</name>
</author>
<link href="/services/workloads/config/workload-management-preflight-checks" rel="list"/>
<link href="/services/workloads/config/workload-management-preflight-checks/_reload" rel="_reload"/>
<content type="text/xml">
<s:dict>
<s:key name="cgroup_version">
<s:dict>
<s:key name="mitigation">Cgroup version must be version 1.</s:key>
<s:key name="preflight_check_status">1</s:key>
<s:key name="title">Cgroup Version</s:key>
</s:dict>
</s:key>
<s:key name="cpu_splunk_base_dir_permission">
<s:dict>
<s:key name="mitigation">CPU Splunk base directory Splunkd.service requires read and write permissions.</s:key>
<s:key name="preflight_check_status">1</s:key>
<s:key name="title">CPU Splunk base directory permissions</s:key>
</s:dict>
</s:key>
<s:key name="cpu_splunk_base_dir_present">
<s:dict>
<s:key name="mitigation">CPU Splunk base directory Splunkd.service is missing.</s:key>
<s:key name="preflight_check_status">1</s:key>
<s:key name="title">CPU Splunk base directory present</s:key>
</s:dict>
</s:key>
<s:key name="delegate_set">
<s:dict>
<s:key name="mitigation">The 'Delegate' property in the unit file must be set to 'true'. Restart Splunk then rerun preflight checks.</s:key>
<s:key name="preflight_check_status">1</s:key>
<s:key name="title">Delegate property set to true</s:key>
</s:dict>
</s:key>
<s:key name="eai:acl">
<s:dict>
<s:key name="app"></s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">0</s:key>
<s:key name="owner">system</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>admin</s:item>
<s:item>splunk-system-role</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list>
<s:item>admin</s:item>
<s:item>splunk-system-role</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">0</s:key>
<s:key name="sharing">system</s:key>
</s:dict>
</s:key>
<s:key name="general">
<s:dict>
<s:key name="preflight_checks_status">1</s:key>
<s:key name="systemd_present">1</s:key>
</s:dict>
</s:key>
<s:key name="launched_under_systemd">
<s:dict>
<s:key name="mitigation">In the unit file, the 'Restart' property must be set to 'always'. The 'ExecStart' property must include '_internal_launch_under_systemd'. Make sure the up-to-date unit file is loaded.</s:key>
<s:key name="preflight_check_status">1</s:key>
<s:key name="title">Splunk launched under systemd</s:key>
</s:dict>
</s:key>
<s:key name="memory_splunk_base_dir_permission">
<s:dict>
<s:key name="mitigation">Memory Splunk base directory Splunkd.service requires read and write permissions.</s:key>
<s:key name="preflight_check_status">1</s:key>
<s:key name="title">Memory Splunk base directory permissions</s:key>
</s:dict>
</s:key>
<s:key name="memory_splunk_base_dir_present">
<s:dict>
<s:key name="mitigation">Memory Splunk base directory Splunkd.service is missing.</s:key>
<s:key name="preflight_check_status">1</s:key>
<s:key name="title">Memory Splunk base directory present</s:key>
</s:dict>
</s:key>
<s:key name="platform_type">
<s:dict>
<s:key name="mitigation">Operating system must be Linux.</s:key>
<s:key name="preflight_check_status">1</s:key>
<s:key name="title">Operating System</s:key>
</s:dict>
</s:key>
<s:key name="unit_file_present">
<s:dict>
<s:key name="mitigation">Unit file Splunkd.service is missing. Restart Splunk then rerun preflight checks.</s:key>
<s:key name="preflight_check_status">1</s:key>
<s:key name="title">Unit file present</s:key>
</s:dict>
</s:key>
</s:dict>
</content>
</entry>
</feed>
workloads/config/set-base-dirname
https://<host>:<mPort>/services/workloads/config/set-base-dirname
Set the name of the splunk parent cgroup.
Authentication and Authorization
Requires the edit_workload_pools capability.
POST
Set the name of the splunk parent cgroup.
Request parameters
| Name | Type | Description |
|---|---|---|
| workload_pool_base_dir_name | String | Specifies the parent level cgroup for splunk. This setting applies only to systems running non-systemd setups. With systemd, this setting is ignored. |
Returned values
None
Example request and response
XML Request
curl -k -u admin:pass https://localhost:8089/services/workloads/config/set-base-dirname -d "workload_pool_base_dir_name=splunkbase"
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-config</title>
<id>https://localhost:8089/services/workloads/config</id>
<updated>2018-08-29T14:54:31-07:00</updated>
<generator build="fc353da83307" version="7.2.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/config/_reload" rel="_reload"/>
<link href="/services/workloads/config/_acl" rel="_acl"/>
<link href="/services/workloads/config/disable" rel="disable"/>
<link href="/services/workloads/config/enable" rel="enable"/>
<link href="/services/workloads/config/get-base-dirname" rel="get-base-dirname"/>
<link href="/services/workloads/config/set-base-dirname" rel="set-base-dirname"/>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
</feed>
workloads/status
https://<host>:<mPort>/services/workloads/status
Get information on the current status of workload management.
Authentication and Authorization
Requires the list_workload_pools capability.
GET
Get information on the current status of workload management.
Request parameters
| Name | Type | Description |
|---|---|---|
| advanced | Boolean | advanced=1 returns dispatch time for each process running in each search pool.
|
Returned values
General information:
| Name | Type | Description |
|---|---|---|
| default_pool | String | Specifies the workload pool marked as the default pool. |
| ingest_pool | Number | Specifies the workload pool marked as the ingest pool. |
| error_message | String | Displays the last error message observed while trying to enable workload management. This message is reset to empty on each successful enablement of workload management. |
| enabled | Boolean | Specifies whether or not workload management is enabled. |
| isSupported | Boolean | Specifies whether or not workload management is supported on this machine. |
| os_build | String | Specifies the operating system build information. |
| os_extended_name | String | Specifies the extended name of the underlying operating system. |
| os_name | String | Specifies the name of the underlying operating system. |
| os_version | String | Specifies the operating system version. |
Workload pools:
| Name | Type | Description |
|---|---|---|
| cpu_weight' | Number | Specifies the fraction of the cpu assigned to this pool as a ratio of the total of cpu_weight across all pools. This fraction is then applied to the cpu shares assigned to the parent group. |
| mem_weight | Number | Specifies the fraction of the memory assigned to this pool as a ratio of the total of mem_weight across all pools. This fraction is then applied to the memory limits assigned to the parent group. |
Workload rules:
| Name | Type | Description |
|---|---|---|
| predicate | String | Specifies the predicate condition that must match to access a workload pool. This must be of the format "app=<value>" or "role=<value". For example, app=itsi, role=admin. No other predicate formats are supported. |
| workload_pool | String | Specifies the workload pool to associate with the workload rule. |
| order | Number | Specifies the evaluation order for this workload rule amongst a group of workload rules. |
Example request and response
XML Request
curl -k -u admin:pass https://localhost:8089/services/workloads/status
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>workload-status</title>
<id>https://localhost:8089/services/workloads/status</id>
<updated>2018-08-29T13:53:48-07:00</updated>
<generator build="fc353da83307" version="7.2.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/workloads/status/_acl" rel="_acl"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>workload-management-status</title>
<id>https://localhost:8089/services/workloads/status/workload-management-status</id>
<updated>1969-12-31T16:00:00-08:00</updated>
<link href="/services/workloads/status/workload-management-status" rel="alternate"/>
<author>
<name>system</name>
</author>
<link href="/services/workloads/status/workload-management-status" rel="list"/>
<content type="text/xml">
<s:dict>
<s:key name="eai:acl">
<s:dict>
<s:key name="app"></s:key>
<s:key name="can_list">1</s:key>
<s:key name="can_write">1</s:key>
<s:key name="modifiable">0</s:key>
<s:key name="owner">system</s:key>
<s:key name="perms">
<s:dict>
<s:key name="read">
<s:list>
<s:item>admin</s:item>
<s:item>analyst</s:item>
<s:item>splunk-system-role</s:item>
</s:list>
</s:key>
<s:key name="write">
<s:list/>
</s:key>
</s:dict>
</s:key>
<s:key name="removable">0</s:key>
<s:key name="sharing">system</s:key>
</s:dict>
</s:key>
<s:key name="general">
<s:dict>
<s:key name="default_pool">default_search_pool</s:key>
<s:key name="enabled">1</s:key>
<s:key name="error_message"></s:key>
<s:key name="ingest_pool">default_ingest_pool</s:key>
<s:key name="isSupported">1</s:key>
<s:key name="os_build">#1 SMP Wed Oct 19 11:24:13 EDT 2016</s:key>
<s:key name="os_extended_name">Linux</s:key>
<s:key name="os_name">Linux</s:key>
<s:key name="os_version">3.10.0-514.el7.x86_64</s:key>
</s:dict>
</s:key>
<s:key name="workload-pools">
<s:dict>
<s:key name="default_ingest_pool">
<s:dict>
<s:key name="cpu_group">/sys/fs/cgroup/cpu/system.slice/Splunkd.service/default_ingest_pool</s:key>
<s:key name="cpu_weight">25</s:key>
<s:key name="mem_group">/sys/fs/cgroup/memory/system.slice/Splunkd.service/default_ingest_pool</s:key>
<s:key name="mem_weight">25</s:key>
</s:dict>
</s:key>
<s:key name="default_search_pool">
<s:dict>
<s:key name="cpu_group">/sys/fs/cgroup/cpu/system.slice/Splunkd.service/default_search_pool</s:key>
<s:key name="cpu_weight">25</s:key>
<s:key name="mem_group">/sys/fs/cgroup/memory/system.slice/Splunkd.service/default_search_pool</s:key>
<s:key name="mem_weight">25</s:key>
</s:dict>
</s:key>
<s:key name="pool_2">
<s:dict>
<s:key name="cpu_group">/sys/fs/cgroup/cpu/system.slice/Splunkd.service/pool_2</s:key>
<s:key name="cpu_weight">20</s:key>
<s:key name="mem_group">/sys/fs/cgroup/memory/system.slice/Splunkd.service/pool_2</s:key>
<s:key name="mem_weight">20</s:key>
</s:dict>
</s:key>
</s:dict>
</s:key>
<s:key name="workload-rules">
<s:dict>
<s:key name="rule_3">
<s:dict>
<s:key name="order">1</s:key>
<s:key name="predicate">role=analyst</s:key>
<s:key name="workload_pool">pool_2</s:key>
</s:dict>
</s:key>
</s:dict>
</s:key>
</s:dict>
</content>
</entry>
</feed>
Last modified on 22 September, 2021
| System endpoint descriptions |
This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10
Download manual
Feedback submitted, thanks!