We are installing new Splunk Enterprise 6.1 Server on Linux machine. We have 2 possible approaches: using a SAN ( Storage Area Network ) where we would like to put Splunk indexes OR use a local drive. What I need to know is how do I measure the performance between the 2 approaches ( SAN vs Local drive ). Can Splunk use SAN to fetch data and will the queries will be slower, knowing that our SAN could be on the same hardware? What are the best practices? Any tools to measure IO operations of Splunk searches will be appreciated.