topic Re: Windows or Linux in Getting Data In

Windows or Linux

louieb3 — Thu, 08 Aug 2013 20:26:51 GMT

We are purchasing Splunk and I wanted to see if there is any advantage on using a Linux box over a Windows box or vice versa.

Thanks in advance.

Re: Windows or Linux

Dimitri_McKay — Thu, 08 Aug 2013 21:08:48 GMT

This is a religious argument, honestly. I myself run everything on Linux, but from what I understand, there's really no performance difference between the two when running Splunk. The one thing I would mention, however, is that if you plan on pulling WMI data WITHOUT a forwarder, you'll need a Windows indexer to do so.

Re: Windows or Linux

lukejadamec — Fri, 09 Aug 2013 00:54:16 GMT

Remote monitoring of Windows systems with WMI is risky because data can get lost. The Universal Forwarder is lightweight, and any Windows system that has a problem with it has larger problems.

Re: Windows or Linux

lukejadamec — Fri, 09 Aug 2013 01:03:48 GMT

This is a philosophical argument. Splunk was built with a Unix structure. As such, I say it was also built with a Unix mind set.

Regardless, the more important question is, “which system do you prefer?”

This is because 1) Splunk is designed to effectively integrate into each OS, and 2) Splunk implementation will require significant adaptation to your environment.

So, “If you were going to integrate a system that manages massive amounts machine data, would you prefer to do the work on a Unix system or a Windows system?”

Re: Windows or Linux

KarunK — Fri, 09 Aug 2013 06:48:16 GMT

As all the above comments depends on which environment you are comfortable with. Best suited for Linux. Mine is in on Redhat Linux.

Re: Windows or Linux

kristian_kolb — Fri, 09 Aug 2013 08:25:38 GMT

The HW specs for Windows are a bit higher. Other than that, if you are more familiar with a particular platform - go with that.

Re: Windows or Linux

amit_saxena — Fri, 09 Aug 2013 12:06:15 GMT

Hi,

If the data you are searching is OS format independent, like apache web server logs, it does not matter if the OS of indexer ( if data is collected there itself ) / forwarder is different from OS of the search head.

However if the data that is searched is OS format dependent, then you need to install the app for the OS, which is same as the OS of indexer ( if data is collected there itself ) / forwarder, on the search head OS if both search head OS and indexer / forwarder OS is different.

Regards,
Amit Saxena

Re: Windows or Linux

lukejadamec — Sat, 10 Aug 2013 03:28:03 GMT

Mine is on Windows, and my Splunk bends Redhat to my will.

Re: Windows or Linux

louieb3 — Mon, 12 Aug 2013 16:12:19 GMT

Thank you, all. We decided to go with Linux as the answers below reinforced the way we were thinking.