Getting Data In

Does a Windows indexer write data out to a SAN location differently than a Linux indexer?

griffeyt53
New Member

Does a Linux Windows indexer write data out to a SAN location differently than a Linux indexer? Are they semantically the same?

Sorry for the confusion - restated - Does a Windows indexer write data out to a SAN location differently than a Linux indexer. Are they semantically the same? Thanks!

0 Karma

Richfez
SplunkTrust
SplunkTrust

No, except for the obvious differences in path name.

As long as the endianness of a system is the same as some other one (which is extremely likely unless you get into VAXes or old IBM mainframes and stuff), the files in the variously configured "indexes" folder are compatible with one another.

I know this for a fact because for some various test systems, I copy an index of about 1.2 GB between 3 different systems - two linux of different distributions and one Windows. Assuming you have the permissions right and the paths set up correctly, those indexes work perfectly well on all systems.

There IS one note - When editing conf files (or xml - anything text based), Windows uses a different line ending than Unix. This is more or less just cosmetic, so that if you open a windows-edited file on a Linux you'll see a lot of special metacharacters ^M at the end of each line, and if you open a file saved in a Linux on Windows, notepad (which until recently didn't understand those line endings) would put everything on one line because ... it didn't understand the linux line endings. 🙂

In all those line endings cases, just search <mytool> convert line ending and that'll probably get you help. If you can't find good results (for like "notepad convert line endings") then use your OS generic ones, like Windows convert line endings. OR, just stop using Notepad and use ANY ONE of the available free text editors that each are a million times better. Notepad++, Editpad, ...

0 Karma

griffeyt53
New Member

Sorry for the confusion - restated - Does a Windows indexer write data out to a SAN location differently than a Linux indexer. Are they semantically the same? Thanks!

0 Karma

oangarita
Explorer

How are you planning to do the copy?

I use volumes for the index cold / db directories.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...