Getting Data In

How do we monitor Disk I/O in Splunk?

dwin02
Explorer

Hi Splunk Support,

When activating the Performance Monitoring in inputs.conf, I was able to send free disk space to Splunk, but how do I activate monitoring of Disk I/O?

Please advise?

Thanks,
Aldwin

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

The same will hold true for *nix if you are using the Splunk_TA_nix. There is a modular input you can enable...

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

Thats from the default/inputs.conf file. You should copy this to the local/inputs.conf, enable it, and adjust the interval to your desired time polling interval.

Once configured, restart, and search!

pgreer_splunk
Splunk Employee
Splunk Employee

There is an example configuration stanza for inputs.conf that shows Bytes/sec. Is this what you are looking for (for perfmon in Windows)?

[perfmon://LocalPhysicalDisk]
interval = 0
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = PerfMon

dwin02
Explorer

thank you both for your help.
much appreciated!!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...