Step 2: Start Splunk
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Step 2: Start Splunk
Splunk can run as any user on the local system. If you run Splunk as a non-root user, make sure that Splunk has the appropriate permissions to read the inputs that you specify. Refer to the instructions for running Splunk as a non-root user for more information.
Start Splunk on non-Windows platforms
Splunk's command line interface is located in $SPLUNK_HOME/bin/. Navigate to this location and run the following command:
# ./splunk start
Use whatever path you installed under.
Start Splunk on Windows platforms
On Windows, Splunk is installed by default into \Program Files\Splunk
You can start and stop the following Splunk processes via the Windows Services Manager:
- Server daemon:
splunkd - Web interface:
splunkweb
You can also start, stop, and restart both processes at once by going to \Program Files\Splunk\bin and typing
# splunk.exe [start|stop|restart]
Startup options
The first time you start Splunk after a new installation, you are presented with the license agreement and asked to accept the license. You can specify a number of different flags to affect
If you want to bypass these steps, you can start Splunk and accept the license in one step:
$SPLUNK_HOME start --accept-license
Where $SPLUNK_HOME is where you installed Splunk.
Note: There are two dashes before the accept-license option.
Important: If this is an upgrade to 3.2 or later, you can preview the changes to be made to your configuration files during migration. Refer to the upgrade instructions for more details.
Launch Splunk Web and log in
Access Splunk Web at
Replace mysplunkhost:8000 with the host and port you specified during the installation.
Use username "admin" and password "changeme" to login to your new Splunk installation for the first time.
Set up one or more data inputs
The first time you browse a new installation, you will see a Guided Setup tool that helps you set up data inputs, licenses, and other configuration options. Alternately, you can configure data inputs from the command line. Below is a typical example.
/opt/splunk/bin/splunk add tail /var/log
Your Splunk Server should show indexed data on its home page immediately after you add a data input. As soon as you see a number greater than "0 events" listed on the server's home page, you're ready to start Splunking!
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 View the Article History for its revisions.