https://community.splunk.com/t5/Getting-Data-In/Should-we-run-Splunk-Enterprise-forwarders-on-Windows-or-Linux/m-p/134580#M27654 <P>I would run everything on linux that will give you a beter performance you can run all apps on both Windows and Linux, you just can't use all the TA's on both. This is correct and makes sense when you think about it, because on Windows there is no /var/log/ directory to monitor... The problem you were having with the *nix app was that it was the config of the TA you were trying to save, you can safely ignore that and remove the visibility of that part, in the manage app menu of Splunk. </P> Wed, 22 Jul 2015 11:52:58 GMT aholzel 2015-07-22T11:52:58Z https://community.splunk.com/t5/Getting-Data-In/Should-we-run-Splunk-Enterprise-forwarders-on-Windows-or-Linux/m-p/134579#M27653 <P>We are rebuilding our distributed search Splunk environment:</P> <P>1 Deployment Server<BR /> 1 Dedicated Search Head<BR /> 1 License Server<BR /> 4 Indexer Servers<BR /> Client Fwd servers will be running Linux or Windows</P> <P>We would like to run the entire environment on Linux but am concerned that some of the console apps will not work (i.e. MSSQL apps). For example we are running it on Windows now and we tried to install the Splunk App for *nix and it would not us use it. The save button was greyed out and it told us that we need to run it on Linux. Is this in our head? Do we need to have it running on Linux to monitor linux, and the same for Windows?</P> <P>Any insight is MUCH appreciated!</P> Wed, 22 Jul 2015 10:56:17 GMT https://community.splunk.com/t5/Getting-Data-In/Should-we-run-Splunk-Enterprise-forwarders-on-Windows-or-Linux/m-p/134579#M27653 brent_weaver 2015-07-22T10:56:17Z https://community.splunk.com/t5/Getting-Data-In/Should-we-run-Splunk-Enterprise-forwarders-on-Windows-or-Linux/m-p/134580#M27654 <P>I would run everything on linux that will give you a beter performance you can run all apps on both Windows and Linux, you just can't use all the TA's on both. This is correct and makes sense when you think about it, because on Windows there is no /var/log/ directory to monitor... The problem you were having with the *nix app was that it was the config of the TA you were trying to save, you can safely ignore that and remove the visibility of that part, in the manage app menu of Splunk. </P> Wed, 22 Jul 2015 11:52:58 GMT https://community.splunk.com/t5/Getting-Data-In/Should-we-run-Splunk-Enterprise-forwarders-on-Windows-or-Linux/m-p/134580#M27654 aholzel 2015-07-22T11:52:58Z