Monitoring Splunk

Testing Splunk systems with IOzone - how to interpret results?


Does anyone on here know how to interpret results from the IOzone disk benchmarking app to identify the results most relevant to Splunk?


  • Reader
  • Writer
  • Fread
  • Fwrite
  • Re-reader
  • Re-writer
  • Random Read
  • Random Write
  • Record Rewrite
  • Re-fread
  • Re-fwrite
  • Backward Read
  • Stride Read

The output data is in a table of "Record Sizes" from 4-16384, by "File Sizes" from 64 to 524288.

Tags (1)
0 Karma


Hmm, I don't know IOzone. I have used bonnie++

Bonnie++ is available at

bonnie++ -d /volume -s <2xmemory>

<2xmemory> means twice the RAM on the system, and /volume is the path to local disk or NFS/SAN where the Splunk datastore will live. Splunk should not be running; in fact, Splunk doesn't need to be installed. Look for

  • sequential output rewrite; should be in the range 30,000-50,000 K/sec (affects indexing)
  • sequential input block; should be >100,000 K/sec (affects indexing)
  • random seeks; should be >1000/sec) (affects search)
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!