This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12
Starting with version 3.4 of Splunk, you can enable a lighter configuration of Splunk designed especially for desktop machines like Windows and Mac laptops. Splunk desktop is not a Splunk forwarder, but rather a scaled-back Splunk for use on non-production-level hardware. Use the Splunk desktop configuration for your own personal Splunk installation, or when you're trying out Splunk on your laptop for the first time.
This configuration scales back the indexing throughput and disables the file system change monitor. This keeps Splunk from using a lot of memory and processing power on systems you use for other purposes (like laptops).
To alter the configuration of Splunk desktop (to add back in a specific input type, for example), you can edit the setup.conf for the SplunkDesktop application in $SPLUNK_HOME/etc/apps/SplunkDesktop/default, where SPLUNK_HOME is the directory into which you installed Splunk.
Note: Splunk desktop is configured by default when you install Splunk on Windows. You can disable it and run Splunk in its standard configuration by following the instructions below.
Note: The Splunk desktop configuration disables deployment server functionality, but supports running as a deployment client. To run the Splunk deployment server, you must disable the desktop configuration app.
To enable Splunk desktop via Splunk Web:
1. Log into Splunk Web.
2. Navigate to the Admin section, and click Applications.
The Applications:View/Manage Applications page is displayed.
3. Find SplunkDesktop and click Enable.
4. Restart Splunk server from Server > Control screen.
The application is enabled.
When you disable Splunk desktop, Splunk reverts to a standard deployment. This means that all limits on indexing and throughput are removed, and Splunk will use more memory and processing power.
1. Log into Splunk Web.
2. Navigate to the Admin section, and click Applications.
The Applications:View/Manage Applications page is displayed.
3. Find SplunkDesktop and click Disable.
4. Restart Splunk server from Server > Control screen.
The application is disabled.
To enable Splunk desktop via the CLI:
./splunk enable app SplunkDesktop -auth <username>:<password> ./splunk restart
To disable Splunk desktop via the CLI:
./splunk disable app SplunkDesktop -auth <username>:<password> ./splunk restart