topic Re: Regarding Running RHEL7 and RHEL8 on the Splunk Environment in Installation

Regarding Running RHEL7 and RHEL8 on the Splunk Environment

dhana22 — Wed, 16 Aug 2023 17:25:01 GMT

Hello, We have Splunk Enterprise in our PROD environment and we have about 18 Indexers, 13 Search Heads and 1 CM/Deployer/LicenseMaster and all of the servers are in Red Hat Enterprise Linux Server release 7.9 (Maipo), we are planning to add additional servers for Indexexs and Search Heads and the new hardware will be in RHEL8, Is it okay if we have RHEL7 and RHEL8 running on the same Splunk environment? please advice.

Thanks,
Dhana

Re: Regarding Running RHEL7 and RHEL8 on the Splunk Environment

richgalloway — Wed, 16 Aug 2023 20:59:10 GMT

Splunk doesn't care what flavor of Linux you use. As long as the kernel is a supported version you'll be fine.

Re: Regarding Running RHEL7 and RHEL8 on the Splunk Environment

gcusello — Thu, 17 Aug 2023 06:54:13 GMT

Hi @dhana22,

there's no problem until the last version of Splunk is certified for Linux Kernel grater than 3.X.

Ciao.

Giuseppe

Re: Regarding Running RHEL7 and RHEL8 on the Splunk Environment

dhana22 — Fri, 18 Aug 2023 02:46:14 GMT

Hello, But as per the Splunk document it says we need to have the same OS version. Please confirm.

https://docs.splunk.com/Documentation/Splunk/9.1.0/Indexer/Systemrequirements#:~:text=Each%20cluster%20node%20(manager%2C%20peer,same%20operating%20system%2C%20including%20version

Operating system requirements

Indexer clustering is available on all operating systems supported for Splunk Enterprise. For a list of supported operating systems, see System requirements in the Installation Manual.

All indexer cluster nodes (manager node, peer nodes, and search heads) must run on the same operating system and version.

If the indexer cluster is integrated with a search head cluster, then the search head cluster instances, including the deployer, must run on the same operating system and version as the indexer cluster nodes.

Thanks,

Dhana

Re: Regarding Running RHEL7 and RHEL8 on the Splunk Environment

gcusello — Fri, 18 Aug 2023 06:57:05 GMT

Hi @dhana22 ,

it's always prefereable to have the same operating system, but for my knowledge isn't mandatory.

Instead Splunk version must be the same in all the Search Peers and Master Node and Search Heads must have the same or higher version than Search Peers.

Ciao.

Giuseppe