Some crossed wires here I think. I did not ask whether cross OS event forwarding works (I know it does, and is supported)
I have only asked about mixed OS infrastructure clusters (search/CMs/Peers) - which is mentioned in splunk docs, but only in the case where all infrastructure instances being the same OS as supported.
I want to use a linux search head to search a windows, multi site indexer cluster. That, it seems, is not supported, which you have demonstrated to work. Some organistions will not use unsupported configurations, even if it works.
Ultimately I want to replace a windows indexing cluster with a linux indexing cluster, but this migration is not possible whilst staying within the supported configuration - mixing OSs for SH/CM/Indexer instances is not supported.
I was sent to splunk answers to ask this question by a Splunk person in the UK - that 'answers was the place to ask this question'. It seems the formal answer is found by raising a support case.
I appreciate your help with demonstrating it, but i was always after a "is this supported" statement from splunk themselves - not from the community - hence my first response to you (are you a splunk person). Sometimes answers is not the best forum for questions/discussions.
... View more