Cluster throughput in Dell Isilon NAS
A bottleneck in an application’s throughput can produce latency spikes, meaning users can no longer interact with the storage system in real-time. A plateau in throughput usually indicates you’ve saturated your infrastructure in some respect. You would like an aggregation of the throughput being consumed by your Isilon cluster.
Data required
Procedure
Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype=emc:isilon:* stats.key=ifs.bytes.*.rate Cluster_Name="<name of cluster>"
| eval {stats.key}='stats.value'
| timechart span=15m p99(ifs.bytes.*) AS ifs.bytes.*
Search explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
|
Splunk Search |
Explanation |
|---|---|
|
sourcetype=emc:isilon:* |
Search only EMC Isilon data. |
|
stats.key=ifs.bytes.*.rate |
Search for events where the stats key is set to "ifs.bytes.in.rate" or "ifs.bytes.out.rate", which describe the cumulative throughput rate on the Isilon file system (IFS). |
|
Cluster_Name="<name of cluster>" |
Enter the cluster name here to limit the search to a specific cluster. You can also omit this filter entirely and get the metric for all the clusters. |
|
| eval {stats.key}='stats.value' |
Assign the stats value to each unique stats.key. In this example we have two eval fields, one for in and one for the in.rate and one for the out.rate. |
|
| timechart span=15m p99(ifs.bytes.*) AS ifs.bytes.* |
Graph the results in fifteen minute increments. |
Next steps
This search produces a time chart that shows throughput values in the 99th percentile for both bytes in, which are writes, and bytes out, which are reads.
Finally, you might be interested in other processes associated with the Managing Dell Isilon network attached storage use case.