Windows or Linux

[louieb3]

We are purchasing Splunk and I wanted to see if there is any advantage on using a Linux box over a Windows box or vice versa.

Thanks in advance.

[louieb3]

Thank you, all. We decided to go with Linux as the answers below reinforced the way we were thinking.

[amit_saxena · Accepted solution]

Hi,

If the data you are searching is OS format independent, like apache web server logs, it does not matter if the OS of indexer ( if data is collected there itself ) / forwarder is different from OS of the search head.

However if the data that is searched is OS format dependent, then you need to install the app for the OS, which is same as the OS of indexer ( if data is collected there itself ) / forwarder, on the search head OS if both search head OS and indexer / forwarder OS is different.

Regards,
Amit Saxena

[KarunK]

As all the above comments depends on which environment you are comfortable with. Best suited for Linux. Mine is in on Redhat Linux.

[lukejadamec]

Mine is on Windows, and my Splunk bends Redhat to my will.

[lukejadamec]

This is a philosophical argument. Splunk was built with a Unix structure. As such, I say it was also built with a Unix mind set.

Regardless, the more important question is, “which system do you prefer?”

This is because 1) Splunk is designed to effectively integrate into each OS, and 2) Splunk implementation will require significant adaptation to your environment.

So, “If you were going to integrate a system that manages massive amounts machine data, would you prefer to do the work on a Unix system or a Windows system?”

[Dimitri_McKay]

This is a religious argument, honestly. I myself run everything on Linux, but from what I understand, there's really no performance difference between the two when running Splunk. The one thing I would mention, however, is that if you plan on pulling WMI data WITHOUT a forwarder, you'll need a Windows indexer to do so.

[kristian_kolb]

The HW specs for Windows are a bit higher. Other than that, if you are more familiar with a particular platform - go with that.

/K

[lukejadamec]

Remote monitoring of Windows systems with WMI is risky because data can get lost. The Universal Forwarder is lightweight, and any Windows system that has a problem with it has larger problems.