Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise
- :
- Re: Splunk on Windows - Disable message about work...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have a nice day!
I have several Splunk instances and often see the message below:
WorkloadsHandler [111560 TcpChannelThread] - Workload mgmt is not supported on this system.
I know that the workload feature is not supported on the windows system, and it is obviously disabled
How can I get rid of this annoying message in the splunkd.log?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @NoSpaces,
You can reduce the log level of WorkloadsHandler in %SPLUNK_HOME%\etc\log-local.cfg. Create the file if it does not exist and add the following:
[splunkd]
category.WorkloadsHandler=FATALRestart Splunk to allow the change to take effect.
You can temporarily change the active level on a running instance from Settings > Server settings > Server logging > WorkloadsHandler or using the REST API:
curl -k -u admin https://localhost:8089/services/server/logger/WorkloadsHandler -d level=FATALcurl is shipped with all modern releases of Windows, but you can use whichever HTTP client you prefer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @NoSpaces,
You can reduce the log level of WorkloadsHandler in %SPLUNK_HOME%\etc\log-local.cfg. Create the file if it does not exist and add the following:
[splunkd]
category.WorkloadsHandler=FATALRestart Splunk to allow the change to take effect.
You can temporarily change the active level on a running instance from Settings > Server settings > Server logging > WorkloadsHandler or using the REST API:
curl -k -u admin https://localhost:8089/services/server/logger/WorkloadsHandler -d level=FATALcurl is shipped with all modern releases of Windows, but you can use whichever HTTP client you prefer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How did you disable the workload management? Via web, cli, or rest?
What is the host system producing these messages? (e.g. various indexers? Search head?) Can you then go to those hosts and then disable workload management in the CLI?
Ref: https://docs.splunk.com/Documentation/Splunk/9.2.1/Workloads/Enableworkloadmanagement
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I didn't disable workload management because I couldn't enable it
This feature is not supported by Windows installation
These messages are generated by members of IDXC, manager node and only one SHC (cluster captain)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you try explicitly disabling workload management? Tscroggins has the instructions to do that above.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
