Bonnie:Bonnie++ is our preferred performance benchmarking tool. It closely simulates Splunk’s I/O pattern and is the best tool we've found to detect performance bottlenecks when it comes to indexing and search. Having this information will help determine the relative performance of local disk vs. NFS/SAN and set the bar on expected performance with your current hardware. Bonnie++ is available at http://www.coker.com.au/bonnie++. Once complied, run bonnie with the following command and we can analyze the results: bonnie++ -d /volume -s <2xmemory> "2xmemory" means twice the RAM on the system, and "/volume" is the path to local disk or NFS/SAN where the Splunk datastore will live. Please make sure your Splunk server is stopped when running bonnie if it happens to be running. Please note: Bonnie++ does not require a Splunk installation. The metrics we are interested in and their preferred ranges:

• sequential output rewrite (30,000-50,000 K/sec) - affects indexing/merge

• sequential input block (>100,000 K/sec) - affects indexing • random seeks (>1000/sec) - affects search

Importantreads:http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3Fhttp://www.splunk.com/wiki/Deploying_Splunk_Light_Forwarders