Skip to content
This repository was archived by the owner on Sep 2, 2025. It is now read-only.

Commit bf2eb0a

Browse files
author
Tracey Carter
committed
copied to Splunk Enterprise setup doc step 8
1 parent 806e41c commit bf2eb0a

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

logs/set-up-logconnect.rst

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -100,19 +100,19 @@ In your Splunk Enterprise search head, follow the instructions in the guided set
100100
:width: 100%
101101
:alt: This screenshot shows the Create user page in Splunk Enterprise where you can assign a user to the service account role.
102102

103-
8. Add a Workload Rule in Splunk Enterprise to limit the amount of time that Log Observer Connect searches can run. This limit maintains a responsive experience for Log Observer users and reduces the chances that Log Observer Connect searches are queued. Follow the guidance in :new-page:`Create a Workload Rule in Splunk Web <https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Admin/CreateWLMRules#Create_a_workload_rule_in_Splunk_Web>` and configure the rule as follows:
103+
8. Add a Workload Rule in Splunk Cloud Platform to limit Log Observer Connect searches to 5 minutes. This limit maintains a responsive experience for Log Observer users and reduces the chances that Log Observer Connect searches are queued. Follow the guidance in :new-page:`Create a Workload Rule in Splunk Web <https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Admin/CreateWLMRules#Create_a_workload_rule_in_Splunk_Web>` and configure the rule as follows:
104104

105105
.. code-block:: none
106106
107107
Predicate: user=[your_Log_Observer_Connect_service-account_name] AND runtime>5m
108108
Schedule: Always on
109109
Action: Abort search
110110
111+
After creating the Workload Rule, it appears in Workload Management on the Workload Rules tab as follows:
112+
111113
.. image:: /_images/logs/WorkloadMgmt.png
112114
:width: 100%
113-
:alt: This screenshot shows the configuration of the Workload Rule.
114-
115-
The Workload Rule limits each Log Observer Connect search to 5 minutes.
115+
:alt: This screenshot shows the configuration of the Workload Rule limiting Log Observer Connect searches to 5 minutes.
116116

117117
9. Obtain certificates for securing inter-Splunk communication. See :new-page:`Configure and install certificates in Splunk Enterprise for Splunk Log Observer Connect <https://quickdraw.splunk.com/redirect/?product=Observability&location=splunk.integration.third.party&version=current>` to learn how. Copy only the first certificate in the chain and paste it on the next page of the guided setup to securely connect Log Observer Connect and your Splunk Enterprise instance.
118118

0 commit comments

Comments
 (0)