How do we monitor Disk I/O in Splunk?

[dwin02]

Hi Splunk Support,

When activating the Performance Monitoring in inputs.conf, I was able to send free disk space to Splunk, but how do I activate monitoring of Disk I/O?

Please advise?

Thanks,
Aldwin

[esix_splunk]

The same will hold true for *nix if you are using the Splunk_TA_nix. There is a modular input you can enable...

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

Thats from the default/inputs.conf file. You should copy this to the local/inputs.conf, enable it, and adjust the interval to your desired time polling interval.

Once configured, restart, and search!

[pgreer_splunk]

There is an example configuration stanza for inputs.conf that shows Bytes/sec. Is this what you are looking for (for perfmon in Windows)?

[perfmon://LocalPhysicalDisk]
interval = 0
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = PerfMon

[dwin02]

thank you both for your help.
much appreciated!!!