How can I measure I/O on my Splunk hardware?

[Yancy]

The Capacity Planning for Splunk page recommends disks that are:

capable of 800 IO operations / second (IOPS)

What are some ways that I can measure potential throughput? I might have access to some secondhand hardware, and this would be one of the main criteria I use before accepting it for Splunk use.

[dwaddle]

The SplunkIT app does not exactly do IOPS measurement, but it should be useful for getting useful benchmark measurements against a Splunk indexer.

[oreoshake]

They also recommend running bonnie++ as it mimics Splunk disk usage

[chicodeme]

how about these parameters?
./bonnie++ -n 0 -u 0 -r free -m | grep 'Mem:' | awk '{print $2}' -s $(echo "scale=0;free -m | grep 'Mem:' | awk '{print $2}'*2" | bc -l) -f -b -d /tmp

[gkanapathy]

You do have to be careful to run bonnie++ with the right of parameters (defaults tend to be on the small side for memory and disk sizes from several years ago) to get meaningful results, or you will just wind up testing the speed of your cache.

[Mick · Accepted solution]

It really depends on your platform, Unix has several utilities that give you information on this - iostat, dtrace, vmstat etc - this page contains useful information on all of these.

The Unix app for Splunk contains 'iostat' and 'vmstat' scripted inputs, and you can configure/create any other ones you would like to visualize

For Windows, you will likely need to install some custom tool as there's not really an equivalent to the Unix commands above, but the Splunk for Windows app will give you other useful information.

[gkanapathy]

Windows WMI Performance counters are quite good. You'll want the PhysicalDisk operations per second counters for measurement.