Splunk Index filesystem recommendations

[brent_weaver]

Hello all! Happy new year. I have my splunk indexes going to a filesystem that is XFS with the following mount options:

/dev/md0 on /opt/splunk type xfs (rw,relatime,attr2,inode64,sunit=1024,swidth=4096,noquota)

I am seeing performance issues and do want to leave no stone unturned. What are peoples thoughts on these mount options? What should I change if any?

[simon_branton_h]

Concerning these mount options, I think that those would be fine. My only concern would be the sunit and swidth options, which should be set based on the hardware RAID options that you are using.

http://xfs.org/index.php/XFS_FAQ#Q:_How_to_calculate_the_correct_sunit.2Cswidth_values_for_optimal_p...