IO wait time on standalone Splunk enterprise server is very high

[jkalra]

We have a standalone server running all the functions and have close to 24 cores on it. The IO wait times peak to 45-65% during the day. Our search and UI access is pathetically slow.

Any suggestions.??

[gcusello]

Verify throuput in your disks, Splunk requires at least 800 iops, better 1200: The bottleneck is usually disk i/o.
In internet there are many tools to measire it.
Don't use RAID5 and you could distribute your logs in different indexes located in different disks.
Bye.
Giuseppe

[gcusello]

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe