This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4
Some platform-specific installers come in both a package form and a tarball. The Linux build comes in three forms: RPM, deb and tarball. The FreeBSD installer and tarball are both .tgz files. 5.4-intel is the installer, i386 is the tarball. The AIX install comes in tarball form only. We plan to release a native install package in a later release.
Follow the instructions for your specific package or tarball.
Note: If you are using any type of package manager, you must install as root. You do not have to install as root if you are using the tarball installation.
Note:If you are installing using the tarball, Splunk does not create the Splunk user automatically. If you want Splunk to run as a specific user, you must create the user manually.
./bin/setSplunkEnv to set the value of $SPLUNK_HOME to that directory.
./etc/splunk.license with your license.
./bin/splunk start and follow the instructions.
./splunk enable boot-start command. For more information, refer to Configuring Splunk to Start at System Startup.
For AIX 5.3, make sure you are up to date on your service packs. Splunk requires the following service level:
$ oslevel -r 5300-05 $
Note: If you use the tarball installer and install in any directory other than opt/splunk, you must set your path in $Splunk_Home/bin/setSplunkEnv. Find and edit this part of the file:
# Determine Splunk home
if [ -z "${SPLUNK_HOME}" ] ; then
# Modify the following line to suit the location of your splunk install.
SPLUNK_HOME= $YOUR_SPLUNK_LOCATION
[ $DEBUG -eq 1 ] && echo "Splunk home: $SPLUNK_HOME"
Set SPLUNK_HOME to your install location. For example, if you installed in home/user your path is home/user/splunk.
Basic install:
rpm -i splunk-2.1-0.i386.rpm
Override the default installation directory /opt/splunk:
rpm -i --prefix=/opt/splunk2.1/splunk splunk-2.1-0.i386.rpm
If you would like to verify the rpm package signature, you can find our GPG public key here.
Basic install:
dpkg -i splunk-2.1-linux-2.6-intel.deb
The Splunk deb package currently cannot be installed in a directory other than its default, /opt/splunk.
Uninstall:
dpkg -r splunk
Purge (delete everything, even config files):
dpkg -P splunk
Splunk package status:
dpkg --status splunk
List all packages:
dpkg --list
Basic install:
pkg_add splunk-2.1-freebsd-5.4-intel.tgz
Override the default installation directory /opt/splunk:
pkg_add -v -p /usr/splunk splunk-2.1-freebsd-5.4-intel.tgz
Uninstall:
pkg_delete splunk
Uninstall from a non-default directory:
pkg_delete -p /usr/splunk splunk
Splunk package info:
pkg_info -L splunk
List all packages:
pkg_info
You need this in /boot/loader.conf:
kern.maxdsiz=\"2147483648\" # 2GB kern.dfldsiz=\"2147483648\" # 2GB
You need this in /etc/sysctl.conf:
vm.max_proc_mmap=2147483647 machdep.hlt_cpus=0
Basic install:
Override the default installation directory /Applications/splunk:
Command-line install:
Mount the dmg:
hdid splunk_package_name.dmg
Install on the root volume:
installer -pkg splunk.pkg -target /
Command-line install to a different disk or partition:
installer -pkg splunk.pkg -target /Volumes/LaCie\ Disk
-target specifies a target volume, such as another disk, where Splunk will be installed in /Applications/splunk .
To install into a directory other than /Applications/splunk on any volume, use the graphical installer as described above.
Basic install:
pkgadd -d splunk.pkg
Override the default installation directory /opt/splunk:
pkgadd -a none -d splunk.pkg
And then specify the new package base directory when prompted.
Uninstall:
pkgrm splunk
Splunk package info:
pkginfo -l splunk
List all packages:
pkginfo