Monitoring Splunk

Splunk Index filesystem recommendations


Hello all! Happy new year. I have my splunk indexes going to a filesystem that is XFS with the following mount options:

/dev/md0 on /opt/splunk type xfs (rw,relatime,attr2,inode64,sunit=1024,swidth=4096,noquota)

I am seeing performance issues and do want to leave no stone unturned. What are peoples thoughts on these mount options? What should I change if any?

0 Karma

New Member

Concerning these mount options, I think that those would be fine. My only concern would be the sunit and swidth options, which should be set based on the hardware RAID options that you are using.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!