Skip to main content


Splunk Lantern

Cluster throughput in Dell Isilon NAS

You might need to understand cluster throughput in your Dell Isilon (network attached storage) NAS when doing the following:


In order to execute this procedure in your environment, the following data, services, or apps are required:


A bottleneck in an application’s throughput can produce latency spikes, meaning users can no longer interact with the storage system in real-time. A plateau in throughput usually indicates you’ve saturated your infrastructure in some respect. You would like an aggregation of the throughput being consumed by your Isilon cluster. 

To optimize the search shown below, you should specify an index and a time range.

  1. Run the following search: 
sourcetype=emc:isilon:* stats.key=ifs.bytes.*.rate Cluster_Name="<name of cluster>"
| eval {stats.key}='stats.value'
| timechart span=15m p99(ifs.bytes.*) AS ifs.bytes.*

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search



Search only EMC Isilon data.


Search for events where the stats key is set to "" or "ifs.bytes.out.rate", which describe the cumulative throughput rate on the Isilon file system (IFS). 

Cluster_Name="<name of cluster>"

Enter the cluster name here to limit the search to a specific cluster. You can also omit this filter entirely and get the metric for all the clusters. 

| eval {stats.key}='stats.value'

Assign the stats value to each unique stats.key. In this example we have two eval fields, one for in and one for the in.rate and one for the out.rate. 

| timechart span=15m p99(ifs.bytes.*) AS ifs.bytes.*

Graph the results in fifteen minute increments.


This search produces a time chart that shows throughput values in the 99th percentile for both bytes in, which are writes, and bytes out, which are reads. 

  • Was this article helpful?