Deployment Architecture

Nix TA iostat.sh problem

Splunk_U
Path Finder

In splunk NIX TA they have used a script named iostat.sh. In the script the command got used is iostat -xk 1 2 i.e. it is providing the IO statistics extensively and running in every 1 sec for 2 times. Now when I am running this particular command in my linux server it is providing me the r/s and rkB/s value as 0.00 in every 2nd second whether it has some value in the first second.

So whenever I am trying to retrieve the data for sourcetype=iostat it is showing me r/s and rKB/s as 0.00.

Why the data is 0.00 in every 2nd second??? Is there any thing that I am missing???

Tags (3)
0 Karma

Splunk_U
Path Finder

I have found out the answer. in the iostat.sh they are using the command iostat -xk 1 2 because it wants to run the script for two times in a interval of 1 sec. The first result shows from the last time the server got restarted and the second result shows the data for now.
For me I was getting the r/s and rKB/s values are 0 because all the data reading were taking place in the cache.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...