The Splunk Product Best Practices team helped produce this response. Read more about use case examples Splunk® Platform Use Cases on Splunk Docs.
This use case enables system administrators to monitor disk operations and when swapping is executed to know when systems may slow down. I/O operations are time consuming and may impact the user experience. This use case checks the number of disk operations of multiple database hosts, and visualizes it over time.
This use case is from the Splunk Essentials for Infrastructure Troubleshooting and Monitoring app. For more examples, see the Splunk Essentials for Infrastructure Troubleshooting and Monitoring on Splunkbase.
Load data
How to implement: Ingest operating system logs and metrics into Splunk Enterprise. Install the Splunk Add-on for Windows or *nix, and enable iostat monitoring for your entire infrastructure. Enable the iostat.sh scripted input in the Splunk Add-on for Windows or *nix. Find the Splunk Add-on for Windows and Splunk Add-on for Unix and Linux on Splunkbase.
Data check: This use case depends on operating system logs and operating system metrics.
Get insights
Track disk I/O utilization to identify systems that are running high storage operations using the Splunk Add-on for Windows or *nix TA. Build dashboards and alerts to respond when needed and take proactive measures.
Use the following search:
index=* tag=oshost tag=performance tag=storage
| stats avg(total_ops) BY host
Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Help
If no results appear, deploy the Add-ons to the search heads to access the knowledge objects necessary for simple searching. See About installing Splunk add-ons on Splunk Docs for assistance.
For more support, post a question to the Splunk Answers community.
The Splunk Product Best Practices team helped produce this response. Read more about use case examples Splunk® Platform Use Cases on Splunk Docs.
This use case enables system administrators to monitor disk operations and when swapping is executed to know when systems may slow down. I/O operations are time consuming and may impact the user experience. This use case checks the number of disk operations of multiple database hosts, and visualizes it over time.
This use case is from the Splunk Essentials for Infrastructure Troubleshooting and Monitoring app. For more examples, see the Splunk Essentials for Infrastructure Troubleshooting and Monitoring on Splunkbase.
Load data
How to implement: Ingest operating system logs and metrics into Splunk Enterprise. Install the Splunk Add-on for Windows or *nix, and enable iostat monitoring for your entire infrastructure. Enable the iostat.sh scripted input in the Splunk Add-on for Windows or *nix. Find the Splunk Add-on for Windows and Splunk Add-on for Unix and Linux on Splunkbase.
Data check: This use case depends on operating system logs and operating system metrics.
Get insights
Track disk I/O utilization to identify systems that are running high storage operations using the Splunk Add-on for Windows or *nix TA. Build dashboards and alerts to respond when needed and take proactive measures.
Use the following search:
index=* tag=oshost tag=performance tag=storage
| stats avg(total_ops) BY host
Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Help
If no results appear, deploy the Add-ons to the search heads to access the knowledge objects necessary for simple searching. See About installing Splunk add-ons on Splunk Docs for assistance.
For more support, post a question to the Splunk Answers community.
