Getting Data In
Highlighted

Windows or Linux

Path Finder

We are purchasing Splunk and I wanted to see if there is any advantage on using a Linux box over a Windows box or vice versa.

Thanks in advance.

Tags (2)
0 Karma
Highlighted

Re: Windows or Linux

Splunk Employee
Splunk Employee

This is a religious argument, honestly. I myself run everything on Linux, but from what I understand, there's really no performance difference between the two when running Splunk. The one thing I would mention, however, is that if you plan on pulling WMI data WITHOUT a forwarder, you'll need a Windows indexer to do so.

Highlighted

Re: Windows or Linux

Super Champion

Remote monitoring of Windows systems with WMI is risky because data can get lost. The Universal Forwarder is lightweight, and any Windows system that has a problem with it has larger problems.

0 Karma
Highlighted

Re: Windows or Linux

Ultra Champion

The HW specs for Windows are a bit higher. Other than that, if you are more familiar with a particular platform - go with that.

/K

Highlighted

Re: Windows or Linux

Super Champion

This is a philosophical argument. Splunk was built with a Unix structure. As such, I say it was also built with a Unix mind set.

Regardless, the more important question is, “which system do you prefer?”

This is because 1) Splunk is designed to effectively integrate into each OS, and 2) Splunk implementation will require significant adaptation to your environment.

So, “If you were going to integrate a system that manages massive amounts machine data, would you prefer to do the work on a Unix system or a Windows system?”

Highlighted

Re: Windows or Linux

Contributor

As all the above comments depends on which environment you are comfortable with. Best suited for Linux. Mine is in on Redhat Linux.

0 Karma
Highlighted

Re: Windows or Linux

Super Champion

Mine is on Windows, and my Splunk bends Redhat to my will.

0 Karma
Highlighted

Re: Windows or Linux

Communicator

Hi,

If the data you are searching is OS format independent, like apache web server logs, it does not matter if the OS of indexer ( if data is collected there itself ) / forwarder is different from OS of the search head.

However if the data that is searched is OS format dependent, then you need to install the app for the OS, which is same as the OS of indexer ( if data is collected there itself ) / forwarder, on the search head OS if both search head OS and indexer / forwarder OS is different.

Regards,
Amit Saxena

View solution in original post

0 Karma
Highlighted

Re: Windows or Linux

Path Finder

Thank you, all. We decided to go with Linux as the answers below reinforced the way we were thinking.

0 Karma