topic Setting Workload Categories for Workload Management in Reporting

Setting Workload Categories for Workload Management

sanjay_e — Tue, 05 Nov 2019 20:11:50 GMT

How do you determine how much CPU and memory to allocate to Search, Index, and Miscellaneous?

Re: Setting Workload Categories for Workload Management

sandeepmakkena — Tue, 05 Nov 2019 22:19:50 GMT

Here is the information which I think should answer the question.

https://docs.splunk.com/Documentation/Splunk/8.0.0/Capacity/Summaryofperformancerecommendations
https://docs.splunk.com/Documentation/Splunk/8.0.0/Capacity/Referencehardware

Hope this helps, Thanks!

Re: Setting Workload Categories for Workload Management

splunk_zen — Thu, 07 Nov 2019 17:16:18 GMT

I've used the Monitoring Console to gain familiarity with the median and max resource consumption trends for the indexers and Search Heads and set it according to that.

Miscellaneous are scripted/modular inputs so you only need to cover those on your Heavy Forwarders

Above all, remember to set generous headroom and remember the beauty of Workload Categories is this doesn't have to be written in stone and you can change them later with ease.
Let me know if you have a more specific question about WLM

Re: Setting Workload Categories for Workload Management

sanjay_e — Thu, 07 Nov 2019 18:33:39 GMT

Hi splunk_zen,

Thank you for your reply - Do the indexers map directly to ingest and the search heads directly to search? From my understanding, indexers aid when running searches as well, so I thought that it may be inaccurate to set the categories based just on the resource consumption of search heads/indexers.

Also, do you know why the default split is 70:20:10 for search:index:miscellaneous? When I checked the resource consumption, indexers used far more resources than search heads so I wanted to double-check that this approach was fine.

And one last question! Does workload management kick in once we activate it? ie. Should I expect search heads and indexers to go down if they don't have enough resources immediately after we install it?

Re: Setting Workload Categories for Workload Management

splunk_zen — Fri, 08 Nov 2019 10:02:46 GMT

First of all, did you already setup linux cgroups?
Your understanding of indexers is correct, but please spin this into a new question to keep things clearer for everyone