Monitoring Splunk

How to measure performance differences between putting indexes on a Storage Area Network (SAN) vs a local drive?


Hello Splunkers,

We are installing new Splunk Enterprise 6.1 Server on Linux machine. We have 2 possible approaches: using a SAN ( Storage Area Network ) where we would like to put Splunk indexes OR use a local drive. What I need to know is how do I measure the performance between the 2 approaches ( SAN vs Local drive ). Can Splunk use SAN to fetch data and will the queries will be slower, knowing that our SAN could be on the same hardware? What are the best practices? Any tools to measure IO operations of Splunk searches will be appreciated.


0 Karma


Hi royimad,

you can use SpunkIT for exactly this kind of performance benchmarks.
Another approach would be bonnie++, but the results are some kind tricky to interpret ..

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...