Getting Data In

Does a Windows indexer write data out to a SAN location differently than a Linux indexer?

griffeyt53
New Member

Does a Linux Windows indexer write data out to a SAN location differently than a Linux indexer? Are they semantically the same?

Sorry for the confusion - restated - Does a Windows indexer write data out to a SAN location differently than a Linux indexer. Are they semantically the same? Thanks!

0 Karma

Richfez
SplunkTrust
SplunkTrust

No, except for the obvious differences in path name.

As long as the endianness of a system is the same as some other one (which is extremely likely unless you get into VAXes or old IBM mainframes and stuff), the files in the variously configured "indexes" folder are compatible with one another.

I know this for a fact because for some various test systems, I copy an index of about 1.2 GB between 3 different systems - two linux of different distributions and one Windows. Assuming you have the permissions right and the paths set up correctly, those indexes work perfectly well on all systems.

There IS one note - When editing conf files (or xml - anything text based), Windows uses a different line ending than Unix. This is more or less just cosmetic, so that if you open a windows-edited file on a Linux you'll see a lot of special metacharacters ^M at the end of each line, and if you open a file saved in a Linux on Windows, notepad (which until recently didn't understand those line endings) would put everything on one line because ... it didn't understand the linux line endings. 🙂

In all those line endings cases, just search <mytool> convert line ending and that'll probably get you help. If you can't find good results (for like "notepad convert line endings") then use your OS generic ones, like Windows convert line endings. OR, just stop using Notepad and use ANY ONE of the available free text editors that each are a million times better. Notepad++, Editpad, ...

0 Karma

griffeyt53
New Member

Sorry for the confusion - restated - Does a Windows indexer write data out to a SAN location differently than a Linux indexer. Are they semantically the same? Thanks!

0 Karma

oangarita
Explorer

How are you planning to do the copy?

I use volumes for the index cold / db directories.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...