Getting Data In

Adding a Unix indexer to support apps

noy72
New Member

Again, new to Splunk.
I currently have a single instance of Splunkenterprise installed on a Win12 R2 server. We would like to use a few apps that either do not work on a Windows installation, or it has been reported that the app/s runs better on a *nix system.

My plan is to install splunkenterprise on a *nix server as an indexer and instal the apps in question on that server. If I do this, will there be two URLs; one for the Windows Splunk and the other for the *nix Splunk that the userswill have to use? Are there any lessons leared I need to be aware of?

Again, I aprecate all the assistance thus far, this community has been great.
Ron Jones

0 Karma

MoniM
Communicator

Hi @noy72,

There shouldn't be any problem with running dissimilar environments in terms of the OS platform.

you can refer the documentation for the compatibility and the requirements:-

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Systemrequirements

Thanks

0 Karma

noy72
New Member

Thank you MoniM. Can you answer the quetion about different URLs? I just like having as many questions aswered as possible before I take the plunge.
Thank again
Ron Jones

0 Karma

lakshman239
SplunkTrust
SplunkTrust

You would need to consider cases like, how much data would you be ingesting per day? would you have single instance [ for search head and indexing layer] or distributed setup?

If you can, I would suggest using unix, as its easy to manage and also address your concern of certain apps not getting supported on Windows. You can mix and match OS, but sticking to one would be easy to maintain and manage. You can run splunk in virtual machines, if getting a beafy machine would take longer.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Installation/Systemrequirements

0 Karma

noy72
New Member

Thank you. We have adequate overhead on our cotract to support the extra data. If we decided to go the Unix only route, is there a migrate in place procedure to do something like that. We currently have 2+ TB of data i our Splunk instance and would be hard pressed to mirror tht data for migration.

If we use a distributed setup (cluster?) With the Unix instance acting as an indexer and theWindows instance acting as a search head, will apps ran from the Unix instance need to be launced fom a different URL than those launched fro the Windows instance?
Thank you so much for all your help.
Ron Jones

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...