Archive

How can I measure I/O on my Splunk hardware?

Path Finder

The Capacity Planning for Splunk page recommends disks that are:

capable of 800 IO operations / second (IOPS)

What are some ways that I can measure potential throughput? I might have access to some secondhand hardware, and this would be one of the main criteria I use before accepting it for Splunk use.

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

It really depends on your platform, Unix has several utilities that give you information on this - iostat, dtrace, vmstat etc - this page contains useful information on all of these.

The Unix app for Splunk contains 'iostat' and 'vmstat' scripted inputs, and you can configure/create any other ones you would like to visualize

For Windows, you will likely need to install some custom tool as there's not really an equivalent to the Unix commands above, but the Splunk for Windows app will give you other useful information.

View solution in original post

SplunkTrust
SplunkTrust

The SplunkIT app does not exactly do IOPS measurement, but it should be useful for getting useful benchmark measurements against a Splunk indexer.

Communicator

They also recommend running bonnie++ as it mimics Splunk disk usage

Communicator

how about these parameters?
./bonnie++ -n 0 -u 0 -r free -m | grep 'Mem:' | awk '{print $2}' -s $(echo "scale=0;free -m | grep 'Mem:' | awk '{print $2}'*2" | bc -l) -f -b -d /tmp

0 Karma

Splunk Employee
Splunk Employee

You do have to be careful to run bonnie++ with the right of parameters (defaults tend to be on the small side for memory and disk sizes from several years ago) to get meaningful results, or you will just wind up testing the speed of your cache.

Splunk Employee
Splunk Employee

It really depends on your platform, Unix has several utilities that give you information on this - iostat, dtrace, vmstat etc - this page contains useful information on all of these.

The Unix app for Splunk contains 'iostat' and 'vmstat' scripted inputs, and you can configure/create any other ones you would like to visualize

For Windows, you will likely need to install some custom tool as there's not really an equivalent to the Unix commands above, but the Splunk for Windows app will give you other useful information.

View solution in original post

Splunk Employee
Splunk Employee

Windows WMI Performance counters are quite good. You'll want the PhysicalDisk operations per second counters for measurement.

0 Karma