Splunk on Windows - Disable message about workload mgmt unsupported

[NoSpaces]

Have a nice day!
I have several Splunk instances and often see the message below:

WorkloadsHandler [111560 TcpChannelThread] - Workload mgmt is not supported on this system.

I know that the workload feature is not supported on the windows system, and it is obviously disabled
How can I get rid of this annoying message in the splunkd.log?

[tscroggins · Accepted solution]

Hi @NoSpaces,

You can reduce the log level of WorkloadsHandler in %SPLUNK_HOME%\etc\log-local.cfg. Create the file if it does not exist and add the following:

[splunkd]
category.WorkloadsHandler=FATAL

Restart Splunk to allow the change to take effect.

You can temporarily change the active level on a running instance from Settings > Server settings > Server logging > WorkloadsHandler or using the REST API:

curl -k -u admin https://localhost:8089/services/server/logger/WorkloadsHandler -d level=FATAL

curl is shipped with all modern releases of Windows, but you can use whichever HTTP client you prefer.

[marnall]

How did you disable the workload management? Via web, cli, or rest?

What is the host system producing these messages? (e.g. various indexers? Search head?) Can you then go to those hosts and then disable workload management in the CLI?

Ref: https://docs.splunk.com/Documentation/Splunk/9.2.1/Workloads/Enableworkloadmanagement

[NoSpaces]

I didn't disable workload management because I couldn't enable it
This feature is not supported by Windows installation
These messages are generated by members of IDXC, manager node and only one SHC (cluster captain)

[marnall]

Could you try explicitly disabling workload management? Tscroggins has the instructions to do that above.