• Read This First
  • Before you install
    • System Requirements
    • Installing as root
  • What Gets Installed
• Step by Step Installation
  • Step 1: Unpack the software
    • Tarball
    • RPM
    • deb
    • FreeBSD
    • Mac OS
    • Solaris
  • Step 2: Start Splunk
  • Step 3: Install your license
    • Using SplunkWeb
    • From the command line
• Install Splunk Toolbar
  • How to Install the Splunk toolbar for Firefox
    • Install from download page
    • Install from Splunk server
    • Uninstall Splunk toolbar
  • How to install the Splunk toolbar for Internet Explorer (beta)
    • Install Internet Explorer toolbar from download page
    • Install toolbar in Internet Explorer
    • Uninstall Internet Explorer toolbar
• Advanced Installation Topics
  • Automated installation
  • Configure Splunk to Start at System Startup
  • Run Splunk as a non-root user
    • Start Splunk as a non-root user
  • License Management
    • Installing or updating a license
  • Uninstall Splunk
    • RedHat Linux
    • Debian Linux
    • Solaris
    • FreeBSD
    • Manual uninstall
• Upgrade Instructions
  • Read this first before upgrading to 3.0.x
    • All bundles, all the time
    • Terminology changes
    • Event typer changes
    • What will be preserved on upgrade
    • Deployment server
    • License changes
  • Upgrading 2.1.x or 2.2.x to 3.0.x
    • Step 1: Administrative preparation
    • Step 2: Install the 3.0.x package and update your database
    • Step 3: Update and restore your configuration files
  • Upgrading to a later 3.0.x maintenance release
    • For rpm, pkg, and deb upgrades
    • For tar upgrades
• Help
  • Getting Help
    • Accessing help in SplunkWeb
    • Accessing help in the command line (CLI)
    • How can I learn more about Splunk's advanced features?
    • I lost my Splunk.com password. What do I do?
    • How do I report problems?
    • How can I make suggestions?
    • I have some questions that aren't answered here. Where can I get help?
  • Installer options
• Reference
  • File Manifest
  • PGP Public Key
    • Installing the key

Before you install

The 3.0, 3.0.1 and 3.0.2 releases do not support automated migration from prior releases. Do not attempt this or you may overwrite your configuration files. Install and try the release in a separate file path with different ports. If you wish to migrate now, read about manual migration instructions.

System Requirements

Please check the release notes and download page for details on known issues.

Host Operating System

• AIX 5.2 and 5.3
• AIX 5.4 has not yet been tested by Splunk. If you wish to give it a try, please try it on a test server and send us feedback.
• Linux 2.6+ kernel Linux distributions (32-bit and 64-bit) and major 2.4+ kernel Linux distributions with NPTL (32-bit only)
• Solaris 8, 9 & 10 / Sparc
• Solaris 9 & 10 / x86
• Mac OS X 10.4 / PPC & x86
• FreeBSD 6.1 or later

Client Operating System / Browser

• AIX, BSD and Linux: Firefox 1.5 or 2.0; Adobe Flash 9 or higher
• Mac OS X: Firefox 1.5 or 2.0; Adobe Flash 9 or higher
• Windows: Internet Explorer 6 or 7 or Firefox 1.5 or 2.0; Adobe Flash 9 or higher

You can verify your installed version of Flash here

Server Hardware

• 32 and 64-bit architectures are supported for some platforms. See the download page page for details.

File System

• Linux - ext2/3, reiser3, XFS
• Solaris - UFS, ZFS, VXFS
• FreeBSD - FFS, UFS
• Mac - HFS
• AIX - JFS, JFS2, NFS 3/4
• Note: Most other file systems are supported.
• Note: Running Splunk on a filesystem not listed above may result in a startup function named "locktest" being executed by Splunk. "Locktest" is a program that independently tests the start up process.//
• Running "locktest":
  • From the SPLUNK_HOME directory, source in the Splunk environment (bash . bin/setSplunkEnv). This assumes that setSplunkEnv has been properly configured.
  • Run "locktest". If its successful, Splunk supports the file system. If it is unsuccessful, contact support (support@splunk.com).

Minimum

• 1x1.4 GHz CPU, 1 GB RAM on any modern OS
• 100 MB free disk space

Recommended

• 2x3.4 GHz CPU, 4 GB RAM
• Running Splunk in virtual machine (VM) mode will degrade performance.

Storage

• For standard syslog data up to 50% of raw data size. (Tunable to 12% with lower indexing density.)
• For other data sources your compression rates may be lower and your storage requirements may be higher.
• For more information on ways to reduce your index density click here

FreeBSD

To ensure that Splunk functions properly on FreeBSD ensure you have the following /boot/loader.conf:

kern.maxdsiz="2147483648" # 2GB
kern.dfldsiz="2147483648" # 2GB

vm.max_proc_mmap=2147483647
machdep.hlt_cpus=0 

Installing as root

Splunk does not need to be installed as root. However, the user under which Splunk runs must have access rights to read all the data inputs you define. In particular, network data inputs cannot be over priviledged ports, which are usually those lower than 1024 (in particular, Splunk will not be able to accept syslog over the default port of 514).