Deployment Architecture

Nix TA iostat.sh problem

Splunk_U
Path Finder

In splunk NIX TA they have used a script named iostat.sh. In the script the command got used is iostat -xk 1 2 i.e. it is providing the IO statistics extensively and running in every 1 sec for 2 times. Now when I am running this particular command in my linux server it is providing me the r/s and rkB/s value as 0.00 in every 2nd second whether it has some value in the first second.

So whenever I am trying to retrieve the data for sourcetype=iostat it is showing me r/s and rKB/s as 0.00.

Why the data is 0.00 in every 2nd second??? Is there any thing that I am missing???

Tags (3)
0 Karma

Splunk_U
Path Finder

I have found out the answer. in the iostat.sh they are using the command iostat -xk 1 2 because it wants to run the script for two times in a interval of 1 sec. The first result shows from the last time the server got restarted and the second result shows the data for now.
For me I was getting the r/s and rKB/s values are 0 because all the data reading were taking place in the cache.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...