This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 , 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12
This topic will guide you through installing Splunk on the FreeBSD platform.
Note: If you are upgrading, review the upgrade documentation later in this manual and check the migration documentation for any migation considerations before proceeding.
The FreeBSD builds comes in two forms: an installer (5.4-intel) and a tarball (i386). Both are TGZ files.
To install FreeBSD using the intel installer:
pkg_add splunk_package_name-5.4-intel.tgz
This installs Splunk in the default directory, /opt/splunk/
To install Splunk in a different directory:
pkg_add -v -p /usr/splunk splunk_package_name-5.4-intel.tgz
To install Splunk on a FreeBSD system, expand the tarball into an appropriate directory. The default install directory is /opt/splunk.
When installing with the tarball:
splunk user automatically. If you want Splunk to run as a specific user, you must create the user manually.
To ensure that Splunk functions properly on FreeBSD, you must:
1. Add the following to /boot/loader.conf
kern.maxdsiz="2147483648" # 2GB kern.dfldsiz="2147483648" # 2GB machdep.hlt_cpus=0
2. Add the following to /etc/sysctl.conf:
vm.max_proc_mmap=2147483647
A restart of the OS is required for the changes to effect.
To see the list of Splunk packages:
pkg_info -L splunk
To list all packages:
pkg_info
Splunk can run as any user on the local system. If you run Splunk as a non-root user, make sure that Splunk has the appropriate permissions to read the inputs that you specify. Refer to the instructions for running Splunk as a non-root user for more information.
To start Splunk from the command line interface, run the following command:
$SPLUNK_HOME/bin/splunk start
By convention, this document uses:
$SPLUNK_HOME to identify the path to your Splunk installation.
$SPLUNK_HOME/bin/ to indicate the location of the command line interface.
The first time you start Splunk after a new installation, you must accept the license agreement. To start Splunk and accept the license in one step:
$SPLUNK_HOME/bin/splunk start --accept-license
Note: There are two dashes before the accept-license option.
For more information, refer to Splunk startup options
If this is an upgrade to 3.2 or later, you have the option of reviewing changes to be made to your configuration files during migration. Refer to the upgrade instructions for more details.
After you start Splunk and accept the license agreement,
1. In a browser window, access Splunk Web at http://<hostname>:port.
hostname is the host machine.
port is the port you specified during the installation (the default port is 8000).
2. If you are running Splunk with a Free license, Splunk Web launches without prompting you for login information. If you are running Splunk with an Enterprise license, Splunk Web prompts you for login information (default, username admin and password changeme) before it launches.
If you are performing a new installation of Splunk or switching from one license type to another, you must update your license.
Use your local package management commands to uninstall Splunk. In most cases, files that were not originally installed by the package will be retained. These files include your configuration and index files which are under your installation directory.
To uninstall Splunk from the default location:
pkg_delete splunk
To uninstall Splunk from a different location:
pkg_delete -p /usr/splunk splunk