Before you install
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Before you install
The 3.0 and 3.0.1 releases do not support automated migration from prior releases. Do not attempt this or you may overwrite your configuration files. Install and try the release in a separate file path with different ports. If you wish to migrate now, read about manual migration instructions.
System Requirements
Please check the release notes and download page for details on known issues.
Host Operating System
- Linux 2.6+ kernel Linux distributions (32-bit and 64-bit) and major 2.4+ kernel Linux distributions with NPTL (32-bit only)
- Solaris 8, 9 & 10 / Sparc
- Solaris 9 & 10 / x86
- Mac OS X 10.4 / PPC & x86
- ``FreeBSD`` 6.1 or later
Client Operating System / Browser
- Linux: Firefox 1.5 or 2.0; Adobe Flash 9 or higher
- Mac OS X: Firefox 1.5 or 2.0; Adobe Flash 9 or higher
- Windows: Internet Explorer 6 or 7 or Firefox 1.5 or 2.0; Adobe Flash 9 or higher
You can verify your installed version of Flash here
Server Hardware
- 32 and 64-bit architectures are supported.
File System
- Linux - ext2/3, reiser3, XFS
- Solaris - UFS, ZFS, VXFS
- FreeBSD - FFS, UFS
- Mac - HFS
- //Note: Most other file systems are supported.
- Note: Running Splunk on a filesystem not listed above may result in a startup function named "locktest" being executed by Splunk. "Locktest" is a program that independently tests the start up process.
- Running "locktest":
- From the SPLUNK_HOME directory, source in the Splunk environment (bash . bin/setSplunkEnv). This assumes that setSplunkEnv has been properly configured.
- Run "locktest". If its successful, Splunk supports the file system. If it is unsuccessful, contact support (support@splunk.com).
Minimum
- 1x1.4 gHz CPU, 1 GB RAM on any modern OS
- 100 MB free disk space
Recommended
- 2x3.4 gHz CPU, 4 GB RAM
- Running Splunk in virtual machine (VM) mode will degrade performance.
Storage
- 12-50% of raw data size depending on indexing configuration and data source.
FreeBSD
To ensure that Splunk functions properly on FreeBSD ensure you have the following /boot/loader.conf:
kern.maxdsiz="2147483648" # 2GB kern.dfldsiz="2147483648" # 2GB
You also need the following in /etc/sysctl.conf:
vm.max_proc_mmap=2147483647 machdep.hlt_cpus=0
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 View the Article History for its revisions.