Workload rules failing to be applied to saved search

Applicability

Description

The following warn message is being reported for specific scheduled searches:

WARN WorkloadManager [18550 SchedulerThread] - Failed to select user provided workload_pool: standard_perf for search_id=scheduler__[username]_xxxxxxxxxxxxxxxxxx__xxxxxxxxxxxx_at_[timestamp], search_label=Sample search, search_type=saved with error=User does not have required capabilities: list_workload_pools, select_workload_pools.

Investigation

The reported error can be found in the splunkd.log and users can find these using the following SPL:

index=_internal sourcetype=splunkd log_level=WARN component=WorkloadManager "User does not have required capabilities*"

The error itself means the scheduled saved search has a management workload rule manually assigned and this action requires the user account running the saved search to have these capabilities:

• list_workload_pools
• select_workload_pools

Here are some steps that can be used to troubleshoot the behavior:

1. Review the saved search configuration to identify which rule is being manually assigned to the search.
   • This can be done in the Advanced Settings for the saved search under the workload_pool setting.
   • Or on the savedsearches.conf of the app under the saved search stanza.
2. Review the current workload management rules to understand whether this search needs to have the specific rule assigned manually or if it can use the rules and conditions already configured to assign the saved search to the correct pool.

Resolution

If the specific saved search includes both manual and automatic rules, the warning message can be disregarded because while the manual rule might fail, the automatic rule would still be successfully applied.

The other two options would be:

1. Create an automatic rule by using the workload management conditions so the service automatically assigns the right pool to the search.
2. Provide the owner of the search with the requested capabilities, this is by design and a necessary step, Manually assign searches to workload pools:

"To assign a search to a workload pool manually, a role must have list_workload_pools and select_workload_pools capabilities.

Related Links

Manually assign searches to workload pools