Monitoring Splunk

Splunk Index filesystem recommendations

brent_weaver
Builder

Hello all! Happy new year. I have my splunk indexes going to a filesystem that is XFS with the following mount options:

/dev/md0 on /opt/splunk type xfs (rw,relatime,attr2,inode64,sunit=1024,swidth=4096,noquota)

I am seeing performance issues and do want to leave no stone unturned. What are peoples thoughts on these mount options? What should I change if any?

0 Karma

simon_branton_h
New Member

Concerning these mount options, I think that those would be fine. My only concern would be the sunit and swidth options, which should be set based on the hardware RAID options that you are using.

http://xfs.org/index.php/XFS_FAQ#Q:_How_to_calculate_the_correct_sunit.2Cswidth_values_for_optimal_p...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...