Splunk Search

Workload Management - Admission Rules only working on Cluster Master

chrisboy68
Contributor

Hi, 

 

Been struggling to get Workload Admission Rules working properly. After a bunch of testing and monitoring with the MC Workload Dashboards, I can see that only searches generated from the CM are applying the Admission Rule Filter. All other search heads ignore the filter. 

Anyone run into this issue? On 8.1.3 Splunk Enterprise. 

 

Thank you!

 

Chris

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

More information, please.  The question mentions "Cluster Master", "CM", and "MC", but they are two different things.  Which are we talking about?  Where and how did you define the workload admission rules?  Are the search heads clustered?

---
If this reply helps you, Karma would be appreciated.
0 Karma

chrisboy68
Contributor

Hi, The CM is the only node that is applying the Admission Rules. after my test. The MC, has a set of dashboards to monitoring Workload Management - Admission Rules. 

The admission rules are applied at the SH and yes they are clustered. 

 

Thanks!

 

Chris

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...