Splunk Search

Workload Management - Admission Rules only working on Cluster Master

chrisboy68
Contributor

Hi, 

 

Been struggling to get Workload Admission Rules working properly. After a bunch of testing and monitoring with the MC Workload Dashboards, I can see that only searches generated from the CM are applying the Admission Rule Filter. All other search heads ignore the filter. 

Anyone run into this issue? On 8.1.3 Splunk Enterprise. 

 

Thank you!

 

Chris

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

More information, please.  The question mentions "Cluster Master", "CM", and "MC", but they are two different things.  Which are we talking about?  Where and how did you define the workload admission rules?  Are the search heads clustered?

---
If this reply helps you, Karma would be appreciated.
0 Karma

chrisboy68
Contributor

Hi, The CM is the only node that is applying the Admission Rules. after my test. The MC, has a set of dashboards to monitoring Workload Management - Admission Rules. 

The admission rules are applied at the SH and yes they are clustered. 

 

Thanks!

 

Chris

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...