How do you ensure that business-critical searches are not impacted by non-critical searches? How do you divvy up Splunk search capacity among internal teams? How do you assign appropriate resources for ingestion and search? Do you want to monitor runaway/rogue searches in real time and prevent adverse impact on the rest of your users? If you are struggling with these questions, this is the session for you! Splunk Workload Management puts you in control. It allows you to define resource pools, access to them, limit the maximum number of concurrent searches in a pool, and monitor rogue searches. Using Linux cgroups to allocate CPU and memory to different pools, Workload Management allows you to create separate pools for ingestion and search. You can create sub-pools within search to isolate incoming searches. The rules can be defined based on search type, user, roles, application etc. Even better, you can monitor for rogue searches and automatically abort or throttle them.

Speaker(s)
Shalabh Goyal, Principal Product Manager, Splunk
Jeremiah Cutting, Sr Staff IT Engineer, Qualcomm
Bhavin Thaker, Director of Engineering, Splunk

Slides PDF link - https://conf.splunk.com/files/2019/slides/FN1655.pdf?podcast=1577146200

Product: Splunk Enterprise

Track: Foundations/Platform

Level: Intermediate