What are the differences between Splunk app for infrastructure and Splunk app for Windows Infrastructure/Splunk app for Unix

[iom100uk]

I have about 20 windows hosts and 20 linux hosts which I'd like to collect metrics and logs/events from.

How do I choose between running the app for Splunk app for Windows Infrastructure (with relevant addons), and the Splunk app for Unix/Linux (+addons) vs the Splunk app for infrastructure (SAI)?

Is there a comparison somewhere to help me choose?

if it matters we're newbies to Splunk, just getting going with Splunk Enterprise 8.

[bashby_splunk · Accepted solution]

There are a few reasons to use the Splunk App for Infrastructure (SAI) over host-specific monitoring solutions. Here are some that come to mind right now:

• SAI is great for centralized monitoring of different host types (e.g., Windows and Linux hosts).
• SAI uses metrics indexes for metrics storage. This is more efficient than storing metrics in events indexes, and you can use metrics-specific search commands like mstats for data you collect with SAI collection agents. For more info, check out https://docs.splunk.com/Documentation/Splunk/8.0.1/Metrics/Overview.
• If you have ITSI, you can integrate entities from SAI with ITSI, and create ITSI services from SAI entities.

[iom100uk]

As it happens we had a Splunk consultant on site last week who confirmed this. Collecting metrics into the metrics index is the future, and it provides us with a neat route into ITSI. The older dedicated apps are effectively a dead end - I wish I hadn't spent time with them now.

[gcusello]

Hi @iom100uk,
I usually install the dedicated Monitoring Apps, I don't like the Splunk App for Infrastructure.
I found that the last has less features.

Ciao.
Giuseppe