Splunk Health Check

[SN1]

SN1_0-1781159957345.png

i am getting this error, how can i resolve it.

[isoutamo]

As @richgalloway already said this is known issue. It could be also false positive as tresholds are too low. 

There are several articles and discussions of it already. I link just some here:

• https://splunk.my.site.com/customer/s/article/Health-Report-IOWait-Showing-Red
• https://splunk.my.site.com/customer/s/article/iowait
• https://community.splunk.com/t5/Splunk-Enterprise/Why-is-the-health-status-of-IOWait-red/m-p/599097
• https://help.splunk.com/en/splunk-enterprise/administer/monitor/9.0/proactive-splunk-component-monit...
•  

[richgalloway]

The threshold for IOWait alerts defaults to too low a value.  Work with your system admins to determine the best value for your system.

[PickleRick]

If this is a physical machine - check your actual I/O statistics and - if you're really overstressing your hardware - get better one. If this is a VM, check with your virtualization and storage teams if you're overstressing your storage but most probably you'll just want to disable that health check - with VMs it most often just lies.