Monitoring Splunk

How can I measure I/O on my Splunk hardware?

Yancy
Path Finder

The Capacity Planning for Splunk page recommends disks that are:

capable of 800 IO operations / second (IOPS)

What are some ways that I can measure potential throughput? I might have access to some secondhand hardware, and this would be one of the main criteria I use before accepting it for Splunk use.

Tags (1)
1 Solution

Mick
Splunk Employee
Splunk Employee

It really depends on your platform, Unix has several utilities that give you information on this - iostat, dtrace, vmstat etc - this page contains useful information on all of these.

The Unix app for Splunk contains 'iostat' and 'vmstat' scripted inputs, and you can configure/create any other ones you would like to visualize

For Windows, you will likely need to install some custom tool as there's not really an equivalent to the Unix commands above, but the Splunk for Windows app will give you other useful information.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

The SplunkIT app does not exactly do IOPS measurement, but it should be useful for getting useful benchmark measurements against a Splunk indexer.

oreoshake
Communicator

They also recommend running bonnie++ as it mimics Splunk disk usage

chicodeme
Communicator

how about these parameters?
./bonnie++ -n 0 -u 0 -r free -m | grep 'Mem:' | awk '{print $2}' -s $(echo "scale=0;free -m | grep 'Mem:' | awk '{print $2}'*2" | bc -l) -f -b -d /tmp

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You do have to be careful to run bonnie++ with the right of parameters (defaults tend to be on the small side for memory and disk sizes from several years ago) to get meaningful results, or you will just wind up testing the speed of your cache.

Mick
Splunk Employee
Splunk Employee

It really depends on your platform, Unix has several utilities that give you information on this - iostat, dtrace, vmstat etc - this page contains useful information on all of these.

The Unix app for Splunk contains 'iostat' and 'vmstat' scripted inputs, and you can configure/create any other ones you would like to visualize

For Windows, you will likely need to install some custom tool as there's not really an equivalent to the Unix commands above, but the Splunk for Windows app will give you other useful information.

gkanapathy
Splunk Employee
Splunk Employee

Windows WMI Performance counters are quite good. You'll want the PhysicalDisk operations per second counters for measurement.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...