Adding a Unix indexer to support apps

[noy72]

Again, new to Splunk.
I currently have a single instance of Splunkenterprise installed on a Win12 R2 server. We would like to use a few apps that either do not work on a Windows installation, or it has been reported that the app/s runs better on a *nix system.

My plan is to install splunkenterprise on a *nix server as an indexer and instal the apps in question on that server. If I do this, will there be two URLs; one for the Windows Splunk and the other for the *nix Splunk that the userswill have to use? Are there any lessons leared I need to be aware of?

Again, I aprecate all the assistance thus far, this community has been great.
Ron Jones

[MoniM]

Hi @noy72,

There shouldn't be any problem with running dissimilar environments in terms of the OS platform.

you can refer the documentation for the compatibility and the requirements:-

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Systemrequirements

Thanks

[noy72]

Thank you MoniM. Can you answer the quetion about different URLs? I just like having as many questions aswered as possible before I take the plunge.
Thank again
Ron Jones

[lakshman239]

You would need to consider cases like, how much data would you be ingesting per day? would you have single instance [ for search head and indexing layer] or distributed setup?

If you can, I would suggest using unix, as its easy to manage and also address your concern of certain apps not getting supported on Windows. You can mix and match OS, but sticking to one would be easy to maintain and manage. You can run splunk in virtual machines, if getting a beafy machine would take longer.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Installation/Systemrequirements

[noy72]

Thank you. We have adequate overhead on our cotract to support the extra data. If we decided to go the Unix only route, is there a migrate in place procedure to do something like that. We currently have 2+ TB of data i our Splunk instance and would be hard pressed to mirror tht data for migration.

If we use a distributed setup (cluster?) With the Unix instance acting as an indexer and theWindows instance acting as a search head, will apps ran from the Unix instance need to be launced fom a different URL than those launched fro the Windows instance?
Thank you so much for all your help.
Ron Jones