topic Workload Rule but it doesn't work in Splunk Cloud Platform

Workload Rule but it doesn't work

Zarack — Fri, 12 Jan 2024 19:30:13 GMT

I have configured a Workload Rule but it doesn't work, I need all searches that last more than 3 minutes and are not from sc_admin to stop. I tested it in the laboratory and it worked, is there something wrong with my rule?
(search_type=adhoc) AND NOT (role=sc_admin) AND runtime>3m
Remember that I did a lab and the same rule worked.
Splunk Instance version: 9.0.2305.201
Laboratory: 9.1.2308.102

Can you help me please.

Re: Workload Rule but it doesn't work

richgalloway — Fri, 12 Jan 2024 20:23:29 GMT

Make sure WLM is enabled and that there are no other rules with a higher priority that prevent this rule from executing.

Re: Workload Rule but it doesn't work

Zarack — Thu, 18 Jan 2024 19:48:06 GMT

Unfortunately it doesn't work, I configured the same rules in a working instance and it works.

Re: Workload Rule but it doesn't work

dural_yyz — Thu, 18 Jan 2024 20:36:51 GMT

Have you checked the _audit logs to confirm user and roles values?