About workload management

This documentation applies to workload management in Splunk Enterprise only. For documentation that applies to workload management in Splunk Cloud Platform, see Workload Management overview in the Splunk Cloud Platform Admin Manual.

Workload management is a rule-based framework that lets you allocate compute and memory resources to search, indexing, and other workloads in Splunk Enterprise.

Workload management lets you create system resource pools, called workload pools, and allocate search workloads to different pools. You can also monitor long-running searches and perform automated remediation actions.

Workload management lets you:

• Assign resources to critical search workloads.
• Avoid data-ingestion latency due to heavy search load.
• Restrict allocation of resources to low-priority search workloads, such as real-time searches.
• Monitor searches and apply automated remediation, such as aborting a search or throttling resources.

To learn more about workload management, see How workload management works.

For Linux configuration prerequisites, see Set up Linux for workload management.

For workload management configuration instructions, see Configure workload pools.

To learn about automated search placement and monitoring rules, see Configure workload rules.

For instructions on how to deploy workload management in a distributed environment, see Configure workload management on a distributed deployment.