https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275082#M52768 <P>Yes, it is possible.</P> Mon, 14 Dec 2015 08:57:30 GMT MuS 2015-12-14T08:57:30Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275073#M52759 <P>Hello,</P> <P>I have one Splunk instance (Windows) and I would like to add a Linux search head for the indexer. Could I do this? Will this cause problems?</P> <P>Thanks</P> Wed, 09 Dec 2015 08:31:19 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275073#M52759 Afef 2015-12-09T08:31:19Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275074#M52760 <P>This is fully supported. Refer to the documentation on configuring distributed search in order for your SH to use the indexer.</P> Wed, 09 Dec 2015 08:41:53 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275074#M52760 esix_splunk 2015-12-09T08:41:53Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275075#M52761 <P>thank you for your answer, i did not found the information in splunk docs.</P> Wed, 09 Dec 2015 08:51:28 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275075#M52761 Afef 2015-12-09T08:51:28Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275076#M52762 <P>You can mix-and match HW and OS anywhere and it should work fine. The only exception is that if you use a Windows Deployment Server for Linux Forwarders, you are likely to have problems with permissions.</P> Wed, 09 Dec 2015 08:54:02 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275076#M52762 woodcock 2015-12-09T08:54:02Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275077#M52763 <P>No, i have a windows indexer which contains also the deployment server and i would like to add a linux search head for the entreprise security app</P> Wed, 09 Dec 2015 09:07:05 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275077#M52763 Afef 2015-12-09T09:07:05Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275078#M52764 <P>Isn't the Windows Deployment Server for Linux Forwarders even worse? That's what we had in my last place and it was breaking the permission model every single time a deployment was made, so we ended up scripting a fix for it.</P> <P>I thought this wasn't the case on a Linux Deployment Server for Windows Forwarders?</P> <P>What is the alternative then? Have two deployment servers one for Windows and one for Linux?</P> <P>Thanks,<BR /> Javier</P> Wed, 09 Dec 2015 11:24:58 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275078#M52764 javiergn 2015-12-09T11:24:58Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275079#M52765 <P>You are correct, I said it backwards. I went back and fixed my answer.</P> Wed, 09 Dec 2015 17:14:29 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275079#M52765 woodcock 2015-12-09T17:14:29Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275080#M52766 <P>There is one other notable exception: If you are using indexer clustering, all indexers must be at the same OS flavor and version AND Splunk needs to be at the exact same version on all peer nodes as well.<BR /> So you can't have five Windows boxes and two Linux servers be part of a cluster. But no sane person would consider doing that anyway....<BR /> I would generally try to stick with a homogeneous search, indexing &amp; management environment as much as possible (preferably Linux) for all kinds of reasons.</P> Wed, 09 Dec 2015 19:36:28 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275080#M52766 s2_splunk 2015-12-09T19:36:28Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275081#M52767 <P>No, i have one indexer (windows) and i would add a linux search head, is this possible ? </P> Mon, 14 Dec 2015 08:18:21 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275081#M52767 Afef 2015-12-14T08:18:21Z https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275082#M52768 <P>Yes, it is possible.</P> Mon, 14 Dec 2015 08:57:30 GMT https://community.splunk.com/t5/Getting-Data-In/Could-I-install-a-search-head-and-an-indexer-on-different/m-p/275082#M52768 MuS 2015-12-14T08:57:30Z