Why does the Splunk App for Enterprise Security trigger audit warnings about system requirements in a virtualized environment?

[mbarrie_splunk]

In the Splunk App for Enterprise Security on Splunk Cloud, there is a frequent message that the systems don't meet the minimum requirements for Splunk. The message keeps popping up periodically, even on instances that have plenty of memory and Virtual CPUs.

The actual error message is:
One or more machines does not meet the minimum system requirements

[mbarrie_splunk · Accepted solution]

Under Data Inputs->Configuration Checker there is a check that periodically runs the "Audit - ES System Requirements" search. On a virtual system this check will often fail since the number of physical CPU's returned by the REST call in the search is 1. The number of virtual cores, not reflected in the REST call, could be sufficient.

I disabled the configuration check to make the messages go away.