Splunk Enterprise Security
Highlighted

Why does the Splunk App for Enterprise Security trigger audit warnings about system requirements in a virtualized environment?

Splunk Employee
Splunk Employee

In the Splunk App for Enterprise Security on Splunk Cloud, there is a frequent message that the systems don't meet the minimum requirements for Splunk. The message keeps popping up periodically, even on instances that have plenty of memory and Virtual CPUs.

The actual error message is:
One or more machines does not meet the minimum system requirements

Highlighted

Re: Why does the Splunk App for Enterprise Security trigger audit warnings about system requirements in a virtualized environment?

Splunk Employee
Splunk Employee

Under Data Inputs->Configuration Checker there is a check that periodically runs the "Audit - ES System Requirements" search. On a virtual system this check will often fail since the number of physical CPU's returned by the REST call in the search is 1. The number of virtual cores, not reflected in the REST call, could be sufficient.

I disabled the configuration check to make the messages go away.

View solution in original post