Monitoring Splunk

Testing Splunk systems with IOzone - how to interpret results?


Does anyone on here know how to interpret results from the IOzone disk benchmarking app to identify the results most relevant to Splunk?


  • Reader
  • Writer
  • Fread
  • Fwrite
  • Re-reader
  • Re-writer
  • Random Read
  • Random Write
  • Record Rewrite
  • Re-fread
  • Re-fwrite
  • Backward Read
  • Stride Read

The output data is in a table of "Record Sizes" from 4-16384, by "File Sizes" from 64 to 524288.

Tags (1)
0 Karma


Hmm, I don't know IOzone. I have used bonnie++

Bonnie++ is available at

bonnie++ -d /volume -s <2xmemory>

<2xmemory> means twice the RAM on the system, and /volume is the path to local disk or NFS/SAN where the Splunk datastore will live. Splunk should not be running; in fact, Splunk doesn't need to be installed. Look for

  • sequential output rewrite; should be in the range 30,000-50,000 K/sec (affects indexing)
  • sequential input block; should be >100,000 K/sec (affects indexing)
  • random seeks; should be >1000/sec) (affects search)
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!