Splunk Workload Management
Course Description

This course provides the fundamentals of using the Workload Management (WLM) feature in Splunk. In this course, you will learn about WLM concepts and features, requirements to configure WLM in the Splunk environment, using workload pools and rules, and allocating WLM resources.

Instructor-led Training Schedule

Course Prerequisites


  • Splunk Fundamentals 1
  • Splunk Fundamentals 2
  • Splunk Enterprise System Administration


Course Topics

  • Splunk WLM Overview and Concepts
  • WLM Access controls
  • Linux OS requirements for WLM
  • Configuring systemd and non-systemd distributions
  • Configuring workload pools and workload rules
  • Assigning workload pools and rules
Course Objectives

Module 1 – Introduction to WLM

  • Splunk Administrator challenges
  • Overview of WLM
  • WLM concepts
  • CPU and memory resource allocation
  • WLM requirements

Module 2 – Linux Configuration

  • Linux configuration for WLM
  • Configuring systemd distributions
  • Configuring non-systemd distributions
  • WLM role requirements

Module 3 – Configuring WLM in Splunk Enterprise

  • Preflight check
  • Configuring workload categories
  • Configuring workload pools
  • Configuring workload rules
  • Enabling workload management in Splunk

Module 4 – WLM Resource Allocation

  • Assigning searches to WLM
  • Re-assigning workload pools
  • Monitoring WLM in the Splunk Monitoring Console