Monitoring Splunk

Does Disk Block Size matter? Performance increase?

bmacias84
Champion

This has probably been asked before but I will do it again.

A classic debate over the years in RDBs is of block size: smaller block size for transactional systems and larger for data ware house systems. I know that Splunk not a RDB and that this is an OS configuration, but would performance be increased by decreasing or increase the Disk Block Size? By default I believe NTFS and ext2/3 are 4KB. Has anyone done any performance tests?

Only doc I could find even related to the the topic: PerformanceTroubleshooting

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The same considerations apply for Splunk as for relational databases. It depends how you're planning to use it. If you are performing rare searches, a slightly smaller block size may improve performance, because you're not transferring as much data. If you're performing dense searches and reports, you may read fewer blocks, though this effect is probably not large as the block reads are likely to be sequential.

Either way though, with filesystem block sizes in the normal range of 4kb to 64kb and with modern disk sizes and disk transfer times, this is unlikely to make a measurable difference.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The same considerations apply for Splunk as for relational databases. It depends how you're planning to use it. If you are performing rare searches, a slightly smaller block size may improve performance, because you're not transferring as much data. If you're performing dense searches and reports, you may read fewer blocks, though this effect is probably not large as the block reads are likely to be sequential.

Either way though, with filesystem block sizes in the normal range of 4kb to 64kb and with modern disk sizes and disk transfer times, this is unlikely to make a measurable difference.

bmacias84
Champion

Valid response, but has anyone or Splunk performed any testing regarding this?

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...