Getting Data In

How to set workload management rules?

saleshai
Explorer

Hi,

I'm trying to set 2 rules in my workload management pool -

search_type=adhoc AND runtime>1m -> Move search to alternate Pool: limited_perf

&

search_type=adhoc AND runtime>10m -> Abort search

The second condition is not getting picked & I still see many long running searches under the Expensive search dashboard. I thought it is a problem with the way these conditions are defined, so I tried changing it to -

search_type=adhoc AND (runtime>1m AND runtime<=10m) - But its throwing error

ERROR: Workload rule "move_longrunning_to_limited_pool" validation failed with error=invalid predicate format 'runtime<=10m'

Where am I going wrong?

Labels (1)
0 Karma
1 Solution

saleshai
Explorer

Hi, So it did not work even with taking the = sign out.

I figured, the workload rules execute as per sequence. The order of the rules is important. Rules are evaluated in order from top to bottom. When I changed the sequence of both rules, it worked correctly -

Rule 1 - search_type=adhoc AND runtime>10m

Rule 2 - search_type=adhoc AND runtime>1m

(I removed the extra conditions & simplified the query)

View solution in original post

0 Karma

caiosalonso
Path Finder

Hi,

Just checking, if you use just runtime<10m instead of runtime<=10, as below, you get the same invalid predicate format error?

search_type=adhoc AND (runtime>1m AND runtime<10m) 

Also, only the second rule that should abort the search is not working? The first one is working as expected?

 

0 Karma

saleshai
Explorer

Hi, So it did not work even with taking the = sign out.

I figured, the workload rules execute as per sequence. The order of the rules is important. Rules are evaluated in order from top to bottom. When I changed the sequence of both rules, it worked correctly -

Rule 1 - search_type=adhoc AND runtime>10m

Rule 2 - search_type=adhoc AND runtime>1m

(I removed the extra conditions & simplified the query)

0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...