https://community.splunk.com/t5/Alerting/How-to-disable-IOWAIT/m-p/623730#M14566 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/242432">@jcourses</a>&nbsp;,</P><P>right, the iowait check in&nbsp;<SPAN>distributed health reporter is quite aggressive. You can raise the limits by configure health.conf</SPAN></P><P><SPAN>We changed iowait to:</SPAN></P><LI-CODE lang="markup">[feature:iowait] display_name = IOWait indicator:single_cpu__max_perc_last_3m:description = This indicator tracks the IOWait percentage for the single most bottle-necked CPU on the machine running the Splunk Enterprise instance, over the last 3 minute window. By default, this indicator will turn Yellow if the percentage exceeds 5% and Red if it exceeds 10% during this window. indicator:single_cpu__max_perc_last_3m:red = 20 indicator:single_cpu__max_perc_last_3m:yellow = 10</LI-CODE><P>&nbsp;</P><P>meaning iowait is yellow for 10% io wait, red for 20% io wait in a 3 min period.&nbsp;<BR /><BR />best regards,</P><P>Andreas</P> Thu, 08 Dec 2022 14:44:30 GMT schose 2022-12-08T14:44:30Z https://community.splunk.com/t5/Alerting/How-to-disable-IOWAIT/m-p/623550#M14565 <P>We've just upgraded to Splunk 9.0.2 and can see IOWAIT is alerting when logging onto the MASTER that the health is red even though CloudWatch is reporting everything is fine and no complaints from the users.&nbsp;</P> <P>I've spoken to SLT and they are happy for this alert to be disabled.</P> <P>Any ideas?</P> Wed, 07 Dec 2022 15:48:25 GMT https://community.splunk.com/t5/Alerting/How-to-disable-IOWAIT/m-p/623550#M14565 jcourses 2022-12-07T15:48:25Z https://community.splunk.com/t5/Alerting/How-to-disable-IOWAIT/m-p/623730#M14566 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/242432">@jcourses</a>&nbsp;,</P><P>right, the iowait check in&nbsp;<SPAN>distributed health reporter is quite aggressive. You can raise the limits by configure health.conf</SPAN></P><P><SPAN>We changed iowait to:</SPAN></P><LI-CODE lang="markup">[feature:iowait] display_name = IOWait indicator:single_cpu__max_perc_last_3m:description = This indicator tracks the IOWait percentage for the single most bottle-necked CPU on the machine running the Splunk Enterprise instance, over the last 3 minute window. By default, this indicator will turn Yellow if the percentage exceeds 5% and Red if it exceeds 10% during this window. indicator:single_cpu__max_perc_last_3m:red = 20 indicator:single_cpu__max_perc_last_3m:yellow = 10</LI-CODE><P>&nbsp;</P><P>meaning iowait is yellow for 10% io wait, red for 20% io wait in a 3 min period.&nbsp;<BR /><BR />best regards,</P><P>Andreas</P> Thu, 08 Dec 2022 14:44:30 GMT https://community.splunk.com/t5/Alerting/How-to-disable-IOWAIT/m-p/623730#M14566 schose 2022-12-08T14:44:30Z