This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6
This topic describes the procedure for installing on Windows using the GUI installer. More options are available for installation (such as silent installation) if you use the commandline installation.
Note: The Windows App was enabled by default in its app.conf file in versions 4.0-4.0.2. Starting in version 4.0.3, it is disabled in this file by default. Read on for important details:
Important: Running the 32-bit version of Splunk for Windows on a 64-bit platform is not recommended. If you can run 64-bit Splunk on 64-bit hardware, we strongly recommend it. The performance is greatly improved over the 32-bit version.
When you run the Splunk Windows installer, you are given the option to select a user Splunk will run as.
If you install as the Local System user, Splunk will have access to all or nearly all of the important information on your local machine. However, the Local System user has no privileges on other Windows machines by design. If you intend to read Event Logs or performance counters from other machines via WMI, or read network shares for log files, you will need a domain account. That account must be a local Administrator or equivalent, and should have rights to the external data you want to Splunk. Please ask your Windows domain administrator for an account if you are unsure of what credentials to give Splunk.
Minimum permissions required for the two Splunk services:
Required user rights for the splunkd service:
Required user rights for the splunkweb service:
Important: If you change the user Splunk runs as after you have installed, you must ensure that the user you create has the necessary permissions, and also ensure that that user has Full Control permissions to the $SPLUNK_HOME/var directory.
If you specified the wrong user during the installation procedure, you'll see two popup error dialogs telling you this. Complete the installation and then use these instructions to switch to the correct user. You must not start Splunk before doing this.
The Windows installer is an MSI file.
1. To start the installer, double-click the splunk.msi file.
The Welcome panel is displayed.
2. To begin the installation, click Next.
Note: On each panel, you can click Next to continue, Back to go back a step, or Cancel to close the installer.
The licensing panel is displayed.
3. Read the licensing agreement and select "I accept the terms in the license agreement". Click Next to continue installing.
The Customer Information panel is displayed.
4. Enter the requested details and click Next.
The Destination Folder panel is displayed.
Note: Splunk is installed by default into the \Program Files\Splunk.
5. Click Change... to specify a different location to install Splunk, or click Next to accept the default value.
The Logon Information panel is displayed.
Splunk installs and runs two Windows services, splunkd and splunkweb. These services will be installed and run as the user you specify on this panel. You can choose to run Splunk with Local System credentials, or provide a specific account. That account should have local administrator privileges, plus appropriate domain permissions if you are collecting data from other machines.
The user Splunk runs as must have permissions to:
Note: If you install as the Local System user, some network resources may not be available to the Splunk application. Additionally, WMI remote authentication will not work; this user has null credentials and Windows servers normally disallow such connections. Only local data collection with WMI will be available. Contact your systems administrator for advice if you are unsure what user to specify.
6. Select a user type and click Next.
Important: When migrating or upgrading, you must re-specify the user you want Splunk to run as--this information is not automatically maintained from release to release.
If you specified the local system user, proceed to step 8. Otherwise, the Logon Information: specify a username and password panel is displayed.
7. Specify a username and password to install and run Splunk and click Next.
Note: To use an existing user, you can enter or browse for the username and domain details. Splunk recommends using the Browse... button to ensure that you select a valid user. If you cannot browse for the user because that user doesn't exist in your security context, or you mistype the username, your installation will fail. Splunk cannot start without a valid username and password; browsing confirms the user is correct.
The pre-installation summary panel is displayed.
8. Click Install to proceed.
The installer runs and displays the Installation Complete panel.
Caution: If you specified the wrong user during the installation procedure, you will see two popup error windows explaining this. If this occurs, Splunk installs itself as the local system user by default. Splunk will not start automatically in this situation. You can proceed through the final panel of the installation, leaving all boxes checked. Then, use these instructions to switch to the correct user before starting Splunk.
9. Check the boxes to Start Splunk and Start Splunk Web now. Click Finish.
The installation completes, Splunk starts, and Splunk Web launches in a supported browser.
Note: The first time you access Splunk Web after installation, login with the default username admin and password changeme.
To access Splunk Web after you start Splunk on your machine, you can either:
or
http://localhost:8000.
Log in using the default credentials: username: admin and password: changeme . Be sure to change the admin password as soon as possible and make a note of what you changed it to.
Now that you've installed Splunk, what comes next?
If you want the Splunk Web service or the splunkd service to use a different port, you can change the defaults.
From the $SPLUNK_HOME/bin/ directory:
splunk set web-port ####
From the $SPLUNK_HOME/bin/ directory:
splunk set splunkd-port ####
To avoid IE Enhanced Security pop-ups, add the following URLs to the allowed Intranet group or fully trusted group in IE:
If you are performing a new installation of Splunk or switching from one license type to another, you must install or update your license.
To uninstall Splunk, use the Add or Remove Programs option in the Control Panel.