Getting Data In

What would be good IOPS for our new indexer devices?

ddrillic
Ultra Champion

We are in the process of getting physical machines for our infrastructure - amazing thing for us ; -)
What would be good/optimal IOPS for the indexers?

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Minimum 800 per indexer - 1200 or more is better. But, if you can afford it go all SSD and have thousands 🙂

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Minimum 800 per indexer - 1200 or more is better. But, if you can afford it go all SSD and have thousands 🙂

ddrillic
Ultra Champion

Thank you!

0 Karma

ddrillic
Ultra Champion

Quick question @dwaddle - for most of the day, our six indexers operate at 400 IOPS but we have two peaks a day, one around 10 am and one around 3 pm, where we reach 1800 IOPS. The SAs tell us that since most of the day we are at 400 IOPS, then we don't seem to need a higher IOPS devices. What should we do/respond?

Btw, on our current VM indexers, increasing the queues helps with these peaks - we manage to go through these peaks without crashing.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...