How to increase indexer speed or size to write disk?

[HS]

Recently I upgraded splunk enterprise to 9.0.2 version.

After few days, Index queue fill ratio is 100% and indexing rate is 0.

I increased max queue size to 100MB, but still there is a bottleneck on Index Queue.

I think Indexers are too late to write data to disk.

How to change indexer speed or size to write disk?

Please help.

[gcusello]

Hi @HS,

storage performances are the bottleneck of all Splunk installations, infact Splunk requires at least 800 IOPS, and better 1200.

If you haven't so performant disks, you have to find an infrastructural solution, e.g. adding an SSD disks for Hot and Warm buckets.

For more infos about hardware reference, see at https://docs.splunk.com/Documentation/Splunk/9.0.3/Capacity/Referencehardware

Ciao.

Giuseppe