The percentage of Read vs Write utilization should come from your specific Splunk usage scenarios.
Are you running a lot of searches/reports but the indexing volume is less compared to that?
Lets say you think that 40% will be write utilisation and 60% read utilisation.
The formula to calculate IOPS is as the following:
IOPS_total = IOPS_single_drive*number_of_drives/(R + F*W)
IOPS_single_drive - you can obtain this from disk manufacturer or calculate by dividing 1 by disk latency in ms.
number_of_drives - number of drives you are planning to deploy.
R - read utilisation. In our case it is 60% as defined above or 0.6.
W - write utilisation. In our case it is 40% as defined above or 0.4.
F - RAID penalty factor. It depends on the RAID type. For RAID1 as an example for every write request to the controller there are 2 writes to the disks. So the penalty factor is 2. For RAID5 for every write request to the controller there are 4 writes to the disks. Penalty factor is 4 in this case.
... View more