Splunk Enterprise

Receiving errors after upgrading to 8.2.4, like "Sum of 3 Highest per-cpu iowaits reached red Threshold of 15"


I get the following after upgrading to Splunk 8.2.4 on Splunk Ent. + ES. I have a large environment with clustered SHs & Indexers. Thank u for your reply in advance.

"Sum of 3 Highest per-cpu iowaits reached red Threshold of 15" on ES

"Maximum per-cpu iowait reached yellow Threshold of 5" on  Search heads

What do they mean & How do I fix the issues please.


Labels (1)
Tags (1)
0 Karma


We get the same error on our environment too. I've reached out to Splunk Support a few times to get clarification on this.

Is your environment virtualized by chance? Basically this error means you are lacking on your resources. 

CPU iowait means that the CPU was idle during which the system had pending disk I/O requests. Basically the CPU is like "Hey! I have stuff I could be processing but I'm stuck waiting for x, y, and z to complete!"

How to resolve? An upgrade to your storage devices for faster throughput or if you're virtualized, possibly dedicating your virtual resources to Splunk servers.

Depending on how heavy your users are to Splunk - It's relatively harmless. But you may need to look at increasing resources in the future.

Refer to https://docs.splunk.com/Documentation/Splunk/8.2.4/Capacity/Referencehardware for more information on what you should be utilizing for your Splunk servers.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...