Most common splunk self hosted platforms?

[shiraberkovi]

Hello  , 

We are planning integration  that will allow sending the audits from our system to Splunk 

We will start with Splunk self hosted 

and interested to know which platform is more prevalent - Windows or Linux ?

So we could plan our effort .

Thanks,

Shira

[jotne]

I you look at the structure of Splunk folder.  var/log etc/ +++  you will see that its design on the Linux structure.  Yes it works on Windows, but I will guess that all larger installation is based on Linux.

So if you have a choice, go for Linux  (we do use Ubuntu 18.04 and up and its very stable)

[isoutamo]

There are some features which are working only in Linux version, liike @gcusello already said DS in Windows works only for Windows deployment clients. One feature which works only in Linux is SmartStore and if i recall right there are some other too (or at least those are proposed to run only in Linux).

But if you are not needing  those now and later and you are full windows company then you could chose windows otherwise definitely take Linux.

r. Ismo

[gcusello]

Hi @shiraberkovi,

you can use both Windows or Linux as Operative System for a Splunk System, but in my experience I never saw any relevant Splunk production infrastructure on Windows, only on Linux: I use Windows only for test or development, but never for production.

But anyway, it depends on the knowledge you have in your company.

In addition I can say that Linux is easier for back-up, maintenance and installation and requires less resources than Windows.

In addition, if you have to monitor both Linux and windows systems and you want to manage Forwarders (the Splunk agent) using the Deployment Server, it must be Linux, otherwise you could have issues.

Ciao.

Giuseppe