Splunk Enterprise version 8.1 will no longer be supported as of April 19, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. Click here for the latest version.Download topic as PDF
The following are the spec and example files for
# Version 8.1.8 #
# This file contains descriptions of the settings that you can use to # configure search admission control for splunk. # # There is a workload_policy.conf file in the $SPLUNK_HOME/etc/system/default/ directory. # Never change or copy the configuration files in the default directory. # The files in the default directory must remain intact and in their original # location. # # To set custom configurations, create a new file with the name workload_policy.conf in # the $SPLUNK_HOME/etc/system/local/ directory. Then add the specific settings # that you want to customize to the local configuration file. # For examples, see workload_policy.conf.example. You may need to restart the Splunk instance # to enable configuration changes. # # To learn more about configuration files (including file precedence) see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles # # Settings to configure search admission control, including enabling/disabling feature # and other configurations.
admission_rules_enabled = <bool> * Determines whether admission rules are applied to searches. * If set to true, admission rules for pre-filtering searches are applied when a search is dispatched. * Default: 0
# Enable the admission rules defined in workload_rules.conf. [search_admission_control] admission_rules_enabled = 1
Last modified on 18 January, 2022
This documentation applies to the following versions of Splunk® Enterprise: 8.1.8
Feedback submitted, thanks!