Getting Data In

Possible to run Splunk on Windows and Linux in the same environment?

horsefez
SplunkTrust
SplunkTrust

Hi there,

I would like to know if it's possible to have Splunk instances running on linux and windows in the same environment.

We currently have an environment which runs splunk on x86 linux centOS virtual machines.
My company decided to monitor Active Directory security events with splunk.

According to this documentation: http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/AuditActiveDirectory
I need to run splunk on windows to monitor active directory systems.


1. Am I able to just install another indexer on windows and add this one to the existing linux environment?
2. Will this work together?
3. Can this indexer share the licence pool of the existing splunk linux environment?
4. Can I forward data from the windows indexer to the linux indexers?

Kind regards,
pyro_wood

0 Karma
1 Solution

somesoni2
Revered Legend

Ans1. You just need a Heavy forwarder installed on Windows to monitor AD and that HF can send data to your existing Linux Indexer(s).
Ans2. Yes, it'll
Ans3. it's a HF so it has to share the same license pool, and yes it can
Ans4. As mentioned earlier, you need a Heavy forwarder and it'll forwarder the data to your linux indexers.

View solution in original post

somesoni2
Revered Legend

Ans1. You just need a Heavy forwarder installed on Windows to monitor AD and that HF can send data to your existing Linux Indexer(s).
Ans2. Yes, it'll
Ans3. it's a HF so it has to share the same license pool, and yes it can
Ans4. As mentioned earlier, you need a Heavy forwarder and it'll forwarder the data to your linux indexers.

View solution in original post

horsefez
SplunkTrust
SplunkTrust

Perfect, thank you very much 🙂

0 Karma

tred23
Path Finder

Rock On! This is the exact question I was searching for today and the answer is spot on.

Thank you @pyro_wood and @somesoni2. Ya'll made my day.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!