Windows installation

If you are upgrading Splunk for Windows from version 3.2.x to 3.3.x, please review the the Windows migration instructions before proceeding to the upgrade instructions.

Note: When you run the Splunk Windows installer, you are given the option to select a user Splunk will run as. If you install Splunk as the LOCAL SYSTEM user, WMI remote authentication will not work; this user has null credentials and Windows servers normally disallow such connections. If this Splunk instance is only acting as a collector and forwarder of local data, however, this is acceptable.
Important: Changing the user Splunk runs as through the Windows Service Control Panel is not supported; Splunk will stop functioning. Make sure you define and select the user account to correctly reflect the access you want Splunk to have.

Install Splunk

The Windows installer is an MSI file.

1. To start the installer, double-click the splunk.msi file.
The Welcome panel is displayed.

2. To begin the installation, click Next.

Note: On each panel, you can click Next to continue, Back to go back a step, or Cancel to close the installer.

The licensing panel is displayed.

3. Read the licensing agreement and select "I accept the terms in the license agreement". Click Next to continue installing.
The Customer Information panel is displayed.

4. Enter the requested details and click Next.
The Destination Folder panel is displayed.

Note: Splunk is installed by default into the \Program Files\Splunk.

5. Click Change... to specify a different location to install Splunk, or click Next to accept the default value.
The Logon Information panel is displayed.

Splunk installs and runs two Windows services, splunkd and splunkweb. These services will be installed and run as the user you specify on this panel. You can choose to run Splunk with Local System credentials, or provide a specific account. That account should have local administrator privileges, plus appropriate domain permissions if you are collecting data from other machines.

The user Splunk runs as must have permissions to:

Run as a service.
Read whatever files you are configuring it to monitor.
Collect performance or other WMI data.
Write to Splunk's directory.

Note: If you install as the Local System user, some network resources may not be available to the Splunk application. Additionally, WMI remote authentication will not work; this user has null credentials and Windows servers normally disallow such connections. Only local data collection with WMI will be available. Contact your systems administrator for advice if you are unsure what user to specify.

6. Select a user type and click Next.
If you specified the local system user, proceed to step 8. Otherwise, the Logon Information: specify a username and password panel is displayed.

7. Specify a username and password to install and run Splunk and click Next.
Note: To use an existing user, you can enter or browse for the username and domain details. However, if you cannot browse to the user you wish to use, the installation will fail. Splunk recommends that you browse to the domain and username to ensure that you select a valid user.
Important: This panel currently contains a New User Information... button. This button is nonfunctional.
Important: Changing the user Splunk runs as through the Windows Service Control Panel is not supported; Splunk will stop functioning. Make sure you define and select the user account to correctly reflect the access you want Splunk to have.

The Configure Splunk Data Sources panel is displayed.

8. Check or uncheck boxes to tell Splunk what data you want monitored and indexed:

Select which Windows event logs you want indexed
Choose which local registry hives to monitor, and whether or not Splunk should establish a baseline snapshot for them when it starts next. Refer to the documentation about Windows registry inputs for information.
Choose to enable WMI collection of local system data. Refer to the documentation about WMI inputs for more information.

Important: If you choose to enable baseline snapshots of your local registry hives, the next time you start Splunk, it may take a long time to start up and use significant system resources while processing the snapshot. This depends on how large your registry is, and how much of it you plan to monitor. For more information about baseline snapshots and monitoring the Windows registry, refer to Get a baseline snapshot.

The pre-installation summary panel is displayed.

9. Click Install to proceed.
The installer runs and displays the Installation Complete panel. You may see a number of warnings in a command prompt dialog box; you can safely ignore these.

10. Check the boxes to Start Splunk and Start Splunk Web now. Click Finish.
The installation completes, Splunk starts, and Splunk Web launches in a supported browser.

Note: The first time you access Splunk Web after installation, login with the default username admin and password changeme.

Start Splunk

On Windows, Splunk is installed by default into \Program Files\Splunk

You can start and stop the following Splunk processes via the Windows Services Manager:

Server daemon: splunkd
Web interface: splunkweb

You can also start, stop, and restart both processes at once by going to \Program Files\Splunk\bin and typing

#  splunk.exe [start|stop|restart]

Note: If you do not select Start Splunk Services at installation, they will be set to manual startup and therefore will not start after a reboot. You must start them from the Windows Service Manager MMC, and optionally configure auto-start if you want them to start automatically at boot time.

Note: If you chose not to index one or more of the Windows event logs by unchecking the box(es) at the end of the installation process, and want to begin indexing later, edit $SPLUNK_HOME/etc/system/local/inputs.conf as described in Configure inputs via inputs.conf.

Important: You must use two backslashes \\ to escape wildcards in stanza names in inputs.conf.

Launch Splunk in a Web browser

To access Splunk Web after you start Splunk on your machine, open a Web browser and navigate to http://localhost:8000. Log in using the default credentials: username: admin and password: changeme . Be sure to change the admin password as soon as possible and make a note of what you changed it to.

Now that you're ready to use Splunk, refer to the User Manual and begin with the Splunk Tutorial.

Install or upgrade license

If you are performing a new installation of Splunk or switching from one license type to another, you must update your license.

Uninstall Splunk

To uninstall Splunk, use the Add or Remove Programs option in the Control Panel.

Previous: Solaris installation | Next: Startup options

Comments

slpost: my apologies for not responding sooner; i am glad you were able to find the answer in the forum. i've added the information to the topic. thanks!
Posted by sophy on Sep 12 2008, 1:31pm
How do you use it? at the end of the installation, open a web browser and navigate to http://localhost:8000.
I entered a forum question on it, and got my answer.
Posted by slpost on Sep 08 2008, 9:18am
One little piece of information I don't see in the installation.

HOW....DO....YOU....USE.....IT?
do I start a browser and go to a webpage?
do I go to DOS, cd to a directory, and run a command?
do I browse folders and open up a file?
WHAT?
There seems to be a huge step missing here.
Posted by slpost on Sep 08 2008, 6:46am