How to disable IOWAIT?

[jcourses]

We've just upgraded to Splunk 9.0.2 and can see IOWAIT is alerting when logging onto the MASTER that the health is red even though CloudWatch is reporting everything is fine and no complaints from the users. 

I've spoken to SLT and they are happy for this alert to be disabled.

Any ideas?

[schose]

Hi @jcourses ,

right, the iowait check in distributed health reporter is quite aggressive. You can raise the limits by configure health.conf

We changed iowait to:

[feature:iowait]
display_name = IOWait
indicator:single_cpu__max_perc_last_3m:description = This indicator tracks the IOWait percentage for the single most bottle-necked CPU on the machine running the Splunk Enterprise instance, over the last 3 minute window. By default, this indicator will turn Yellow if the percentage exceeds 5% and Red if it exceeds 10% during this window.
indicator:single_cpu__max_perc_last_3m:red = 20
indicator:single_cpu__max_perc_last_3m:yellow = 10

meaning iowait is yellow for 10% io wait, red for 20% io wait in a 3 min period. 

best regards,

Andreas