topic Re: IO wait time on standalone Splunk enterprise server is very high in Deployment Architecture

IO wait time on standalone Splunk enterprise server is very high

jkalra — Wed, 07 Sep 2016 04:57:01 GMT

We have a standalone server running all the functions and have close to 24 cores on it. The IO wait times peak to 45-65% during the day. Our search and UI access is pathetically slow.

Any suggestions.??

Re: IO wait time on standalone Splunk enterprise server is very high

gcusello — Wed, 07 Sep 2016 05:39:38 GMT

Verify throuput in your disks, Splunk requires at least 800 iops, better 1200: The bottleneck is usually disk i/o.
In internet there are many tools to measire it.
Don't use RAID5 and you could distribute your logs in different indexes located in different disks.
Bye.
Giuseppe

Re: IO wait time on standalone Splunk enterprise server is very high

gcusello — Fri, 09 Sep 2016 11:08:28 GMT

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe