Getting Data In

How do we monitor Disk I/O in Splunk?


Hi Splunk Support,

When activating the Performance Monitoring in inputs.conf, I was able to send free disk space to Splunk, but how do I activate monitoring of Disk I/O?

Please advise?


0 Karma

Splunk Employee
Splunk Employee

The same will hold true for *nix if you are using the Splunk_TA_nix. There is a modular input you can enable...

interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

Thats from the default/inputs.conf file. You should copy this to the local/inputs.conf, enable it, and adjust the interval to your desired time polling interval.

Once configured, restart, and search!

Splunk Employee
Splunk Employee

There is an example configuration stanza for inputs.conf that shows Bytes/sec. Is this what you are looking for (for perfmon in Windows)?

interval = 0
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = PerfMon


thank you both for your help.
much appreciated!!!

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...