topic Splunk on Windows - Disable message about workload mgmt unsupported in Splunk Enterprise

Splunk on Windows - Disable message about workload mgmt unsupported

NoSpaces — Mon, 08 Apr 2024 08:58:34 GMT

Have a nice day!
I have several Splunk instances and often see the message below:

WorkloadsHandler [111560 TcpChannelThread] - Workload mgmt is not supported on this system.

I know that the workload feature is not supported on the windows system, and it is obviously disabled
How can I get rid of this annoying message in the splunkd.log?

Re: Splunk on Windows - Disable message about workload mgmt unsupported

marnall — Sat, 13 Apr 2024 07:52:00 GMT

How did you disable the workload management? Via web, cli, or rest?

What is the host system producing these messages? (e.g. various indexers? Search head?) Can you then go to those hosts and then disable workload management in the CLI?

Ref: https://docs.splunk.com/Documentation/Splunk/9.2.1/Workloads/Enableworkloadmanagement

Re: Splunk on Windows - Disable message about workload mgmt unsupported

tscroggins — Sun, 14 Apr 2024 15:37:01 GMT

Hi @NoSpaces,

You can reduce the log level of WorkloadsHandler in %SPLUNK_HOME%\etc\log-local.cfg. Create the file if it does not exist and add the following:

[splunkd] category.WorkloadsHandler=FATAL

Restart Splunk to allow the change to take effect.

You can temporarily change the active level on a running instance from Settings > Server settings > Server logging > WorkloadsHandler or using the REST API:

curl -k -u admin https://localhost:8089/services/server/logger/WorkloadsHandler -d level=FATAL

curl is shipped with all modern releases of Windows, but you can use whichever HTTP client you prefer.

Re: Splunk on Windows - Disable message about workload mgmt unsupported

NoSpaces — Tue, 16 Apr 2024 11:34:20 GMT

I didn't disable workload management because I couldn't enable it
This feature is not supported by Windows installation
These messages are generated by members of IDXC, manager node and only one SHC (cluster captain)

Re: Splunk on Windows - Disable message about workload mgmt unsupported

marnall — Tue, 16 Apr 2024 19:16:28 GMT

Could you try explicitly disabling workload management? Tscroggins has the instructions to do that above.