Workload management of Splunk best practices

1: About systemd cgroup Architecture understanding of ：

Configure Linux systems running systemd - Splunk Documentation

2: From system configuration ：

Run Splunk Enterprise as a systemd service - Splunk Documentation

/opt/splunk/bin/splunk stop

/opt/splunk/bin/splunk disable boot-start

/opt/splunk/bin/splunk enable boot-start -systemd-managed 1 -user splunk -group splunk

/opt/splunk/bin/splunk start

3: After the above configuration is ready , Be careful , It's up there search head / indexer It's all about execution ：

Configure Linux systems running systemd - Splunk Documentation

4: Let's take a look at the resource allocation diagram ：

How workload management works - Splunk Documentation

5: Look at the configuration file ：

About the configuration of the following parameters , You can refer to ：https://docs.splunk.com/Documentation/Splunk/8.2.6/Workloads/Workloadmanagementexamples

About the configuration above , You can see the specific content in the background .

6: login splunk url: setting --> workload management:

7: Log in search head Check ：

Enable workload management - Splunk Documentation

./splunk show workload-management-status --verbose

8: If the original interface operation, etc , You can see the configuration file in the background ：

stay search head server：

splunk btool workload_rules list --debug

Configuration files usually have three ：

root#:/opt/splunk/etc/shcluster/apps/abc_workload_management/local# ls -lrt

total 16

-rw-r--r-- 1 splunk splunk 110 Sep  4  2021 app.conf

-rw------- 1 splunk splunk 791 Jun  9 15:26 workload_rules.conf

-rw------- 1 splunk splunk 651 Jun  9 15:26 workload_pools.conf

-rw------- 1 splunk splunk  55 Jun  9 15:26 workload_policy.conf

For details, please refer to ：

Workload management examples - Splunk Documentation