Archive
Highlighted

Setting Workload Categories for Workload Management

Engager

How do you determine how much CPU and memory to allocate to Search, Index, and Miscellaneous?

0 Karma
Highlighted

Re: Setting Workload Categories for Workload Management

Contributor
0 Karma
Highlighted

Re: Setting Workload Categories for Workload Management

Builder

I've used the Monitoring Console to gain familiarity with the median and max resource consumption trends for the indexers and Search Heads and set it according to that.

Miscellaneous are scripted/modular inputs so you only need to cover those on your Heavy Forwarders

Above all, remember to set generous headroom and remember the beauty of Workload Categories is this doesn't have to be written in stone and you can change them later with ease.
Let me know if you have a more specific question about WLM

View solution in original post

Highlighted

Re: Setting Workload Categories for Workload Management

Engager

Hi splunk_zen,

Thank you for your reply - Do the indexers map directly to ingest and the search heads directly to search? From my understanding, indexers aid when running searches as well, so I thought that it may be inaccurate to set the categories based just on the resource consumption of search heads/indexers.

Also, do you know why the default split is 70:20:10 for search:index:miscellaneous? When I checked the resource consumption, indexers used far more resources than search heads so I wanted to double-check that this approach was fine.

And one last question! Does workload management kick in once we activate it? ie. Should I expect search heads and indexers to go down if they don't have enough resources immediately after we install it?

0 Karma
Highlighted

Re: Setting Workload Categories for Workload Management

Builder

First of all, did you already setup linux cgroups?
Your understanding of indexers is correct, but please spin this into a new question to keep things clearer for everyone

0 Karma