Cluster throughput in Dell Isilon NAS

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

A bottleneck in an application’s throughput can produce latency spikes, meaning users can no longer interact with the storage system in real-time. A plateau in throughput usually indicates you’ve saturated your infrastructure in some respect. You would like an aggregation of the throughput being consumed by your Isilon cluster.

Data required

Dell EMC Isilon data

Procedure

Run the following search. You can optimize it by specifying an index and adjusting the time range.

sourcetype=emc:isilon:* stats.key=ifs.bytes.*.rate Cluster_Name="<name of cluster>"
| eval {stats.key}='stats.value'
| timechart span=15m p99(ifs.bytes.*) AS ifs.bytes.*

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search	Explanation
`sourcetype=emc:isilon:*`	Search only EMC Isilon data.
`stats.key=ifs.bytes.*.rate`	Search for events where the stats key is set to "ifs.bytes.in.rate" or "ifs.bytes.out.rate", which describe the cumulative throughput rate on the Isilon file system (IFS).
`Cluster_Name="<name of cluster>"`	Enter the cluster name here to limit the search to a specific cluster. You can also omit this filter entirely and get the metric for all the clusters.
`\| eval {stats.key}='stats.value'`	Assign the stats value to each unique stats.key. In this example we have two `eval` fields, one for in and one for the `in.rate` and one for the `out.rate`.
`\| timechart span=15m p99(ifs.bytes.) AS ifs.bytes.`	Graph the results in fifteen minute increments.

Next steps

This search produces a time chart that shows throughput values in the 99th percentile for both bytes in, which are writes, and bytes out, which are reads.

Finally, you might be interested in other processes associated with the Managing Dell Isilon network attached storage use case.