Before you download and install the Splunk software, read the following sections for the supported system requirements. If you have ideas or requests for new features to add to future releases, email Splunk Support. Also, you can follow our Product Roadmap.
Refer to the download page for the latest version to download. Check the release notes for details on known and resolved issues.
For a discussion of hardware planning for deployment, check out this topic in the Splunk Community Wiki.
Splunk is supported on the following platforms.
Splunk expects configuration files to be in ASCII/UTF-8. If you are editing or creating a configuration file on an OS that is non-UTF-8, you must ensure that the editor you are using is configured to save in ASCII/UTF-8.
Splunk is a high-performance application. If you are performing a comprehensive evaluation of Splunk for production deployment, we recommend that you use hardware typical of your production environment; this hardware should meet or exceed the recommended hardware capacity specifications below.
Note: Running Splunk in virtual machine (VM) mode on any platform will degrade performance.
| Platform | Recommended hardware capacity/configuration | Minimum supported hardware capacity |
|---|---|---|
| Non-Windows platforms | 2x quad-core Xeon, 3GHz, 8GB RAM, RAID 0 or 1+0, with a 64 bit OS installed. | 1x1.4 GHz CPU, 1 GB RAM |
| Windows platforms | 2x quad-core Xeon, 3GHz, 8GB RAM, RAID 0 or 1+0, with a 64 bit OS installed. | Pentium 4 or equivalent at 2Ghz, 2GB RAM |
Note: Use the minimum supported hardware guidelines for personal use of Splunk.
Important: For all installations including forwarders, a minimum of 2GB hard disk space for your Splunk installation is required in addition to the space required for your index. Refer to this topic on estimating your index size requirements in the Splunk Community area of the KnowledgeBase for some planning information.
Important: The minimum requirements for Splunk apply to all configurations other than Splunk light forwarder instances.
| Recommended | Dual Core 1.5Ghz+ processor, 1GB+ RAM |
| Minimum | 1.0 Ghz processor, 512MB RAM |
For more information on deployment planning, refer to the Deployment section of the Splunk community KnowledgeBase.
| Platform | File systems |
|---|---|
| Linux | ext2/3, reiser3, XFS, NFS 3/4 |
| Solaris | UFS, ZFS, VXFS, NFS 3/4 |
| FreeBSD | FFS, UFS, NFS 3/4 |
| Mac OS X | HFS, NFS 3/4 |
| AIX | JFS, JFS2, NFS 3/4 |
| Windows | NTFS, FAT32 |
NFS is usually a poor choice for Splunk indexing activity, for reasons of performance, resilience, and semantics. In environments with very high bandwidth, very low latency links, that are kept highly reiable, it can be an appropriate choice. Typically this is a SAN which is accessed via the NFS protocol.
Note: Several other file systems are supported. If you run Splunk on a filesystem that is not listed above, Splunk may run a startup utility named locktest. Locktest is a program that tests the start up process. If locktest runs and fails, the filesystem is not suitable for running Splunk.
Note: On FreeBSD, mounting as nullfs is not supported.
32 and 64-bit architectures are supported for some platforms. download page page for details.
Categories: V:4.0.5 | V:4.0.6 | V:4.1beta | V:4.0.7