1: 背景：
今天由于要改变workload managment 里面的workload rule, 发现改了以后，splunk search haead 界面就报错：Failed to read / process workload rule = xxx_abort. Specify a valid workload rule in the workload_rules.conf file.
2: 解决问题：
先看文档：
Configure workload rules - Splunk Documentation
里面action 有这么一段话：
Abort search, Display a Message, and Move search to alternate Pool actions apply to in-progress searches only. You must specify a runtime condition to enable these actions. For example, the predicate index=_internal AND runtime>1m triggers the specified action on all searches that contain index=_internal and run for mo
)
