Run preflight checks in Splunk Web

1. Click Settings > Workload Management.
   The Linux preflight checks run automatically. If all preflight checks pass, the workload management UI opens, and you can proceed to configure workload management.
2. If any preflight check fails, a page appears showing the check results. Review the error messages and fix the specified Linux configuration issues.
3. After fixing the issues, click Rerun preflight checks.

Run preflight checks using the CLI

To run preflight checks for workload management using the CLI:

1. Log in to your Linux machine.
2. Run the following CLI command:

   ./splunk check workload-config
   

   Here is an example of the output from this command:

   Workload Management Preflight Checks failed. Fix the following issues:
   	CPU Splunk base directory Splunkd.service requires read and write permissions.
   	CPU Splunk base directory Splunkd.service is missing.
   	The 'Delegate' property in the unit file must be set to 'true'. Restart Splunk then rerun preflight checks.
   	In the unit file, the 'Restart' property must be set to 'always'. The 'ExecStart' property must include '_internal_launch_under_systemd'. Make sure the up-to-date unit file is loaded.
   	Memory Splunk base directory Splunkd.service requires read and write permissions.
   	Memory Splunk base directory Splunkd.service is missing.
   	Unit file Splunkd.service is missing. Restart Splunk then rerun preflight checks.
   

Run preflight checks using REST

Send a GET request to:

workloads/config/preflight-checks

For endpoint details, see workloads/config/preflight-checks in the REST API Reference Manual.

Edit workload categories using Splunk Web

To edit the resource allocation for a workload category in Splunk Web, do the following:

1. In Splunk Web, click Settings > Workload Management.
   The workload management UI opens.
2. Click the All Categories tile.
3. Click Edit under the specific category.
4. Specify the resource allocation:

   Field	Action
   CPU Weight	Specify the total CPU weight available for pools in this category. Unused CPU cycles are automatically shared with workloads in other categories.
   Memory Limit %	Specify the maximum percentage of Memory available for pools in this category.

5. Click Submit.

For more information, see Resource allocation in workload management.

Edit workload categories using the CLI

To edit the resource allocation for a workload category, run the following CLI command:

./splunk edit workload-category <category> [-cpu_weight <number> -mem_weight <number>]

where <category> is search, ingest, or misc.

To list workload category information, run the following CLI command:

./splunk list workload-category 

Edit workload categories using REST

To edit the resource allocation for a workload category, send a POST request to the following endpoint:

workloads/categories

For endpoint details, see workloads/categories in the REST API Reference Manual.

Create a workload pool in Splunk Web

1. In Splunk Web, click Settings > Workload Management.
2. Click Add Workload Pool.
3. Specify the following fields:

   Field	Action
   Pool Category	Select a workload category based on the type of process the pool will run (search, ingest, or misc). See Configure workload categories.
   Name	Specify the name of the workload pool. Valid characters are alphanumeric and underscore only.
   CPU Weight	The fraction of total available CPU for this pool. Unused CPU cycles are automatically shared with workloads in other pools.
   Memory Limit %	The maximum percentage of total available memory for this pool.
   Default Pool	Toggle the switch to make this pool the default pool for the selected category.

4. Click Submit.
   The workload pool appears in the Workload Management UI.

For more information, see Resource allocation in workload management.

Create a workload pool using the CLI

Run the following CLI command:

./splunk add workload-pool <pool_name> [-category <search/ingest/misc> -cpu_weight <number> -mem_weight <number> -default_category_pool <true|false>]

Create a workload pool using REST

Send a POST request to the following endpoint:

workloads/pools 

For endpoint details, see workloads/pools in the REST API Reference Manual.

View workload_pools.conf

When you create a workload pool, the configuration is stored in $SPLUNK_HOME/etc/apps/<app_name>/local/workload_pools.conf.

workload_pools.conf defines the cpu and memory resource allocation for workload categories (search, ingest, and misc) and the individual workload pools created under those categories. For example:

[general]
default_pool = pool_1
ingest_pool = pool_3
enabled = 0
 
[workload_category:search]
cpu_weight = 70
mem_weight = 70
 
[workload_category:ingest]
cpu_weight = 20
mem_weight = 20
 
[workload_category:misc]
cpu_weight = 10
mem_weight = 10
 
[workload_pool:pool_1]
cpu_weight = 70
mem_weight = 70
category   = search
default_category_pool = 1
 
[workload_pool:pool_2]
cpu_weight = 30
mem_weight = 30
category   = search
default_category_pool = 0

[workload_pool:pool_3]
cpu_weight = 100
mem_weight = 100
category = ingest
default_category_pool = 1
 
[workload_pool:pool_4]
cpu_weight = 100
mem_weight = 100
category = misc
default_category_pool = 1

For more information, see workload_pools.conf.

Delete workload pools

You can delete any workload pool under a category, except for the default category pool. If you try to delete the default category pool an error message appears. You can delete workload pools using Splunk Web, the CLI, or REST API.

To delete a workload pool using the CLI:

./splunk remove workload-pool <pool_name>