https://community.splunk.com/t5/Knowledge-Management/Anyone-using-disk-queue-length-instead-of-disk-time-for-disk/m-p/485316#M8436 <P>Hey Splunkers,</P> <P>Just wondering if anyone had some cool suggestions for better disk metrics</P> <P>We are currently using %_disk_time (among others) for performance monitoring for our hosts</P> <P>While it may be somewhat useful to know that drives are 100% busy, that fact in and of itself, is not as useful.</P> <P>I would expect that drives holding data would be 100% busy because the drive is being read from or written to almost all of the time, especially on some of our more heavily used systems </P> <P>Just from my own basic knowledge, that metric combined with “Average Disk Que Length”, would be more relevant. If a disk is busy almost all of the time, and there is a large queue, the disk might be a bottleneck, and require further investigation.</P> <P>However, I imagine RAID configuration needs to be factored in (which I'm not sure about) -and I'm wondering how others are doing it. Any help is much appreciated </P> <P>I'm currently playing around with it like this:</P> <P>index=windows sourcetype="PerfmonMk:LogicalDisk"<BR /> | stats avg(Current_Disk_Queue_Length) as average by host instance<BR /> | search average&gt;1<BR /> | sort - average</P> Wed, 30 Sep 2020 05:11:24 GMT spluzer 2020-09-30T05:11:24Z https://community.splunk.com/t5/Knowledge-Management/Anyone-using-disk-queue-length-instead-of-disk-time-for-disk/m-p/485316#M8436 <P>Hey Splunkers,</P> <P>Just wondering if anyone had some cool suggestions for better disk metrics</P> <P>We are currently using %_disk_time (among others) for performance monitoring for our hosts</P> <P>While it may be somewhat useful to know that drives are 100% busy, that fact in and of itself, is not as useful.</P> <P>I would expect that drives holding data would be 100% busy because the drive is being read from or written to almost all of the time, especially on some of our more heavily used systems </P> <P>Just from my own basic knowledge, that metric combined with “Average Disk Que Length”, would be more relevant. If a disk is busy almost all of the time, and there is a large queue, the disk might be a bottleneck, and require further investigation.</P> <P>However, I imagine RAID configuration needs to be factored in (which I'm not sure about) -and I'm wondering how others are doing it. Any help is much appreciated </P> <P>I'm currently playing around with it like this:</P> <P>index=windows sourcetype="PerfmonMk:LogicalDisk"<BR /> | stats avg(Current_Disk_Queue_Length) as average by host instance<BR /> | search average&gt;1<BR /> | sort - average</P> Wed, 30 Sep 2020 05:11:24 GMT https://community.splunk.com/t5/Knowledge-Management/Anyone-using-disk-queue-length-instead-of-disk-time-for-disk/m-p/485316#M8436 spluzer 2020-09-30T05:11:24Z