Possible to run Splunk on Windows and Linux in the same environment?

[horsefez]

Hi there,

I would like to know if it's possible to have Splunk instances running on linux and windows in the same environment.

We currently have an environment which runs splunk on x86 linux centOS virtual machines.
My company decided to monitor Active Directory security events with splunk.

According to this documentation: http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/AuditActiveDirectory
I need to run splunk on windows to monitor active directory systems.

---

1. Am I able to just install another indexer on windows and add this one to the existing linux environment?
2. Will this work together?
3. Can this indexer share the licence pool of the existing splunk linux environment?
4. Can I forward data from the windows indexer to the linux indexers?

Kind regards,
pyro_wood

[somesoni2 · Accepted solution]

Ans1. You just need a Heavy forwarder installed on Windows to monitor AD and that HF can send data to your existing Linux Indexer(s).
Ans2. Yes, it'll
Ans3. it's a HF so it has to share the same license pool, and yes it can
Ans4. As mentioned earlier, you need a Heavy forwarder and it'll forwarder the data to your linux indexers.

[horsefez]

Perfect, thank you very much 🙂

[tred23]

Rock On! This is the exact question I was searching for today and the answer is spot on.

Thank you @pyro_wood and @somesoni2. Ya'll made my day.