Getting Data In

Windows or Linux

louieb3
Path Finder

We are purchasing Splunk and I wanted to see if there is any advantage on using a Linux box over a Windows box or vice versa.

Thanks in advance.

Tags (2)
0 Karma
1 Solution

amit_saxena
Communicator

Hi,

If the data you are searching is OS format independent, like apache web server logs, it does not matter if the OS of indexer ( if data is collected there itself ) / forwarder is different from OS of the search head.

However if the data that is searched is OS format dependent, then you need to install the app for the OS, which is same as the OS of indexer ( if data is collected there itself ) / forwarder, on the search head OS if both search head OS and indexer / forwarder OS is different.

Regards,
Amit Saxena

View solution in original post

0 Karma

louieb3
Path Finder

Thank you, all. We decided to go with Linux as the answers below reinforced the way we were thinking.

0 Karma

amit_saxena
Communicator

Hi,

If the data you are searching is OS format independent, like apache web server logs, it does not matter if the OS of indexer ( if data is collected there itself ) / forwarder is different from OS of the search head.

However if the data that is searched is OS format dependent, then you need to install the app for the OS, which is same as the OS of indexer ( if data is collected there itself ) / forwarder, on the search head OS if both search head OS and indexer / forwarder OS is different.

Regards,
Amit Saxena

0 Karma

KarunK
Contributor

As all the above comments depends on which environment you are comfortable with. Best suited for Linux. Mine is in on Redhat Linux.

0 Karma

lukejadamec
Super Champion

Mine is on Windows, and my Splunk bends Redhat to my will.

0 Karma

lukejadamec
Super Champion

This is a philosophical argument. Splunk was built with a Unix structure. As such, I say it was also built with a Unix mind set.

Regardless, the more important question is, “which system do you prefer?”

This is because 1) Splunk is designed to effectively integrate into each OS, and 2) Splunk implementation will require significant adaptation to your environment.

So, “If you were going to integrate a system that manages massive amounts machine data, would you prefer to do the work on a Unix system or a Windows system?”

Dimitri_McKay
Splunk Employee
Splunk Employee

This is a religious argument, honestly. I myself run everything on Linux, but from what I understand, there's really no performance difference between the two when running Splunk. The one thing I would mention, however, is that if you plan on pulling WMI data WITHOUT a forwarder, you'll need a Windows indexer to do so.

kristian_kolb
Ultra Champion

The HW specs for Windows are a bit higher. Other than that, if you are more familiar with a particular platform - go with that.

/K

lukejadamec
Super Champion

Remote monitoring of Windows systems with WMI is risky because data can get lost. The Universal Forwarder is lightweight, and any Windows system that has a problem with it has larger problems.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...