Regarding Running RHEL7 and RHEL8 on the Splunk Environment

[dhana22]

Hello, We have Splunk Enterprise in our PROD environment and we have about 18 Indexers, 13 Search Heads and 1 CM/Deployer/LicenseMaster and all of the servers are in Red Hat Enterprise Linux Server release 7.9 (Maipo), we are planning to add additional servers for Indexexs and Search Heads and the new hardware will be in RHEL8, Is it okay if we have RHEL7 and RHEL8 running on the same Splunk environment? please advice.

Thanks,
Dhana

[gcusello]

Hi @dhana22,

there's no problem until the last version of Splunk is certified for Linux Kernel grater than 3.X.

Ciao.

Giuseppe

[dhana22]

Hello, But as per the Splunk document it says we need to have the same OS version. Please confirm. 

https://docs.splunk.com/Documentation/Splunk/9.1.0/Indexer/Systemrequirements#:~:text=Each%20cluster...

Operating system requirements

Indexer clustering is available on all operating systems supported for Splunk Enterprise. For a list of supported operating systems, see System requirements in the Installation Manual.

All indexer cluster nodes (manager node, peer nodes, and search heads) must run on the same operating system and version.

If the indexer cluster is integrated with a search head cluster, then the search head cluster instances, including the deployer, must run on the same operating system and version as the indexer cluster nodes.

Thanks,

Dhana

[gcusello]

Hi @dhana22 ,

it's always prefereable to have the same operating system, but for my knowledge isn't mandatory.

Instead Splunk version must be the same in all the Search Peers and Master Node and Search Heads must have the same or higher version than Search Peers.

Ciao.

Giuseppe

[richgalloway]

Splunk doesn't care what flavor of Linux you use.  As long as the kernel is a supported version you'll be fine.