Hi @dd_infosec, leaving out for a moment the fact of having Windows on production systems which is something I don't recommend to any customer, it is a best practice to have the same operating system only on systems belonging to the same cluster (e.g. Indexer Cluster). So it is not a problem to add an HF with a newer operating system. The only constraint is the Splunk version which must be equal to or less than that of the Indexers. Ciao. Giuseppe ... View more