Any way to monitor excessive write activity to a server?

[SplunkLunk]

Greetings,

Is there any way to query Splunk to see if host disk drives have excessive write activity vs. read activity?  Trying to monitor for Ransomware infections.  Lots of write activity might indicate files being encrypted/modified.

I am a consumer of our Splunk environment so I don't have the ability to change the environment and I only have access to indexes for which my hosts reside.  For example I don't have access to the _internal index.  Thanks for any help.

[richgalloway]

If you are logging disk read/write activity (not everyone does) then you should be able to query for excessive writes.  Such data would not be in the internal index, but I have no way of knowing where it is in your environment.

[SplunkLunk]

Do you know what a search like that would look like?  I can check and see if those types of events show in the indexes my servers are forwarding to.  Thanks.