topic Re: How can I measure I/O on my Splunk hardware? in Monitoring Splunk

How can I measure I/O on my Splunk hardware?

Yancy — Thu, 17 Jun 2010 20:32:42 GMT

The Capacity Planning for Splunk page recommends disks that are:

capable of 800 IO operations / second (IOPS)

What are some ways that I can measure potential throughput? I might have access to some secondhand hardware, and this would be one of the main criteria I use before accepting it for Splunk use.

Re: How can I measure I/O on my Splunk hardware?

Mick — Thu, 17 Jun 2010 23:34:21 GMT

It really depends on your platform, Unix has several utilities that give you information on this - iostat, dtrace, vmstat etc - this page contains useful information on all of these.

The Unix app for Splunk contains 'iostat' and 'vmstat' scripted inputs, and you can configure/create any other ones you would like to visualize

For Windows, you will likely need to install some custom tool as there's not really an equivalent to the Unix commands above, but the Splunk for Windows app will give you other useful information.

Re: How can I measure I/O on my Splunk hardware?

oreoshake — Fri, 18 Jun 2010 05:41:36 GMT

They also recommend running bonnie++ as it mimics Splunk disk usage

Re: How can I measure I/O on my Splunk hardware?

gkanapathy — Fri, 18 Jun 2010 08:56:33 GMT

You do have to be careful to run bonnie++ with the right of parameters (defaults tend to be on the small side for memory and disk sizes from several years ago) to get meaningful results, or you will just wind up testing the speed of your cache.

Re: How can I measure I/O on my Splunk hardware?

gkanapathy — Fri, 18 Jun 2010 09:01:59 GMT

Windows WMI Performance counters are quite good. You'll want the PhysicalDisk operations per second counters for measurement.

Re: How can I measure I/O on my Splunk hardware?

chicodeme — Fri, 21 Oct 2011 21:13:15 GMT

how about these parameters?
./bonnie++ -n 0 -u 0 -r free -m | grep 'Mem:' | awk '{print $2}' -s $(echo "scale=0;free -m | grep 'Mem:' | awk '{print $2}'*2" | bc -l) -f -b -d /tmp

Re: How can I measure I/O on my Splunk hardware?

dwaddle — Sat, 22 Oct 2011 16:28:46 GMT

The SplunkIT app does not exactly do IOPS measurement, but it should be useful for getting useful benchmark measurements against a Splunk indexer.