topic Re: If I currently have a single Windows server running Splunk, how can I add a new Linux front end server to use apps that require Linux? in Getting Data In

If I currently have a single Windows server running Splunk, how can I add a new Linux front end server to use apps that require Linux?

erickopp — Mon, 26 Oct 2015 18:22:33 GMT

Right now I have Splunk set up on a single Windows server, but have found some apps that require a Linux server to run the apps. I would like to add a Linux front end server to use the Linux apps and keep the Windows server for the apps that require a Windows sever to run from, and keep the indexer there as well for now. I am having trouble finding in the documentation how to set up this configuration. I would assume this would be possible and still have only one site and single pane of glass for my users as well?

Re: If I currently have a single Windows server running Splunk, how can I add a new Linux front end server to use apps that require Linux?

stmyers7941 — Mon, 26 Oct 2015 19:06:21 GMT

Setup the Linux server as a forwarder, and configure the outputs to point to the Windows Splunk instance.

Output.conf on Linux Splunk instance:

[tcpout:windows_indexer]
server=<windows_host/IP>:9997

Also configure the Windows Splunk instance with a Splunk TCP input:
Inputs.conf on Windows Splunk index:

[splunktcp://9997]

Don't forget about firewall on the Windows host, and also any indexes required for apps on the Linux instance will need to be installed on the Windows. Basically, TAs go on Linux, app goes on Windows (if you don't plan on using the Linux front end).