Getting Data In

What would be good IOPS for our new indexer devices?

ddrillic
Ultra Champion

We are in the process of getting physical machines for our infrastructure - amazing thing for us ; -)
What would be good/optimal IOPS for the indexers?

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Minimum 800 per indexer - 1200 or more is better. But, if you can afford it go all SSD and have thousands 🙂

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Minimum 800 per indexer - 1200 or more is better. But, if you can afford it go all SSD and have thousands 🙂

ddrillic
Ultra Champion

Thank you!

0 Karma

ddrillic
Ultra Champion

Quick question @dwaddle - for most of the day, our six indexers operate at 400 IOPS but we have two peaks a day, one around 10 am and one around 3 pm, where we reach 1800 IOPS. The SAs tell us that since most of the day we are at 400 IOPS, then we don't seem to need a higher IOPS devices. What should we do/respond?

Btw, on our current VM indexers, increasing the queues helps with these peaks - we manage to go through these peaks without crashing.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...