Configure cgroups v2 in Splunk Enterprise

Splunk Enterprise 9.3 and higher supports workload management on Linux systems that use cgroups version 1 (cgroups v1) and cgroups version 2 (cgroups v2).

Splunk Enterprise 9.4 and higher supports cgroups v1 and v2. Splunk software automatically detects and implements the cgroup version on your Linux system with no additional action required.

Requirements

To configure Splunk Enterprise 9.4 for Linux cgroups v2:

• You must have Splunk Enterprise version 9.4.x or higher.
• Splunk Enterprise must be installed on a Linux OS running systemd with cgroups v2 enabled, such as RHEL 9.

Splunk Cloud Platform does not support cgroups v2 configuration.

Configure cgroups in Splunk Enterprise 9.4 and higher

To configure cgroups v1 or v2 (or switch between the versions) in Splunk Enterprise 9.4 and higher on Linux OS with systemd:

1. Stop Splunk:

   ./spunk stop
   

2. Disable the Splunk Enterprise boot start script (splunk.init):

   sudo ./splunk disable boot-start
   

3. Upgrade or reconfigure your Linux OS to a version with the desired systemd and cgroups. For details, consult your Linux OS documentation.
4. Enable systemd boot start for Splunk Enterprise. For example:

   sudo ./splunk enable boot-start -systemd-managed 1
   

   For more information, see Run Splunk Enterprise a systemd service in the Splunk Enterprise Admin Manual.

5. Start splunkd:

   sudo systemctl start Splunkd
   

6. Configure workload management as usual, for example using Splunk Web. For more information, see Configure workload pools.

Verify cgroups v2 configuration

To verify cgroups v2 configuration for Workload Management:

1. Start Splunk Enterprise as a systemd service:

   sudo systemctl start Splunkd
   

2. Run the workload management status command.

   ./splunk show workload-management-status --verbose
   

   Review the command output to verify workload management is enabled and supported.

          Workload Management Status:
   
                  Enabled: 1
   
                  Supported: 1
   
                  Error:
   

   Look for lines that show V2 preceding the cgroup path. For example:

   CPU Group: V2:/sys/fs/cgroup:/system.slice/Splunkd.service:/sys/fs/cgroup:/system.slice/Splunkd.service:/ingest:cpu
   Memory Group: V2:/sys/fs/cgroup:/system.slice/Splunkd.service:/sys/fs/cgroup:/system.slice/Splunkd.service:/ingest:memory