Getting Data In

If I currently have a single Windows server running Splunk, how can I add a new Linux front end server to use apps that require Linux?

erickopp
Engager

Right now I have Splunk set up on a single Windows server, but have found some apps that require a Linux server to run the apps. I would like to add a Linux front end server to use the Linux apps and keep the Windows server for the apps that require a Windows sever to run from, and keep the indexer there as well for now. I am having trouble finding in the documentation how to set up this configuration. I would assume this would be possible and still have only one site and single pane of glass for my users as well?

0 Karma

stmyers7941
Path Finder

Setup the Linux server as a forwarder, and configure the outputs to point to the Windows Splunk instance.

Output.conf on Linux Splunk instance:

[tcpout:windows_indexer]
server=<windows_host/IP>:9997

Also configure the Windows Splunk instance with a Splunk TCP input:
Inputs.conf on Windows Splunk index:

[splunktcp://9997]

Don't forget about firewall on the Windows host, and also any indexes required for apps on the Linux instance will need to be installed on the Windows. Basically, TAs go on Linux, app goes on Windows (if you don't plan on using the Linux front end).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...