System requirements

System requirements

Before you download and install the Splunk software, read the following sections for the supported system requirements. If you have ideas or requests for new features to add to future releases, email Splunk Support. Also, you can follow our Product Roadmap.

Refer to the download page for the latest version to download. Check the release notes for details on known and resolved issues.

Caution: Splunk does not provide a direct upgrade path to version 3.2.x from versions earlier than 3.0. You cannot upgrade directly from 2.x to 3.2. If you are upgrading from an earlier version of Splunk, refer to the upgrade and migration instructions for upgrading to 3.0 and upgrade to 3.0 or 3.1 before proceeding.

Host operating system

• Linux 2.6+ kernel Linux distributions (x86 and x86_64) and major 2.4+ kernel Linux distributions with NPTL (x86)
• Solaris 8, 9 & 10 / Sparc
• Solaris 9 & 10 / x86
• Mac OS X 10.4+ / x86 and PPC
• FreeBSD 6.1 (6.2 for 64-bit versions) or later
• AIX 5.2 and 5.3
  • AIX 5.4 has not yet been tested by Splunk. If you want to give it a try, please install it on a test server and send us feedback.
• 32-bit: Windows 2000, XP, Windows Server 2003, Vista, Windows Server 2008
• 64-bit: Windows Server 2003, Vista, Windows Server 2008

Important: Running the 64-bit version of Splunk for Windows on a 32-bit platform is not recommended. If you can run Splunk on 64-bit hardware, we strongly recommend it. The performance is greatly improved over the 32-bit version.

Note: Splunk is certified to to run on English versions of Windows only. Non-English operating systems are not supported.

Note: Windows registry monitoring is not supported on Windows 2000 due to an issue with a Windows 2000 DLL.

Client operating system / browser (for access to Splunk Web)

• AIX, BSD and Linux: Firefox 1.5 or 2.0; Adobe Flash 9 or higher
• Mac OS X: Firefox 1.5 or 2.0; Adobe Flash 9 or higher
• Windows: Internet Explorer 6 or 7 or Firefox 1.5 or 2.0; Adobe Flash 9 or higher

You can verify your installed version of Flash here

Hardware capacity requirements

Splunk is a high-performance application. If you are performing a comprehensive evaluation of Splunk for production deployment, we recommend that you use hardware typical of your production environment; this hardware should meet or exceed the recommended hardware capacity specifications below.

Note: Running Splunk in virtual machine (VM) mode on any platform will degrade performance.

Recommended and minimum hardware capacity

Platform	Recommended hardware capacity	Minimum supported hardware capacity
Non-Windows platforms	2x3.4 GHz CPU, 4 GB RAM	1x1.4 GHz CPU, 1 GB RAM
Windows platforms	Multi-core Xeon or equivalent at 3Ghz, 4GB RAM	Pentium 4 or equivalent at 2Ghz, 2GB RAM

Note: Use the minimum supported hardware guidelines for personal use of Splunk. We recommend you use the Splunk desktop application/configuration when using Splunk on desktops or laptops.

Important: For all installations including forwarders, a minimum of 2GB hard disk space for your Splunk installation is required in addition to the space required for your index. Refer to this topic on estimating your index size requirements in the Splunk Community area of the KnowledgeBase for some planning information.

Important: The minimum requirements for Splunk apply to all configurations other than Splunk light forwarder instances.

Hardware requirements for Splunk light forwarders

Recommended	Dual Core 1.5Ghz+ processor, 1GB+ RAM
Minimum	1.0 Ghz processor, 512MB RAM

For more information on deployment planning, refer to the Deployment section of the Splunk community KnowledgeBase.

Supported server hardware architectures

32 and 64-bit architectures are supported for some platforms. See the download page page for details.

Supported file systems

Platform	File systems
Linux	ext2/3, reiser3, XFS
Solaris	UFS, ZFS, VXFS
FreeBSD	FFS, UFS
Mac OS X	HFS
AIX	JFS, JFS2, NFS 3/4
Windows	NTFS, FAT32

Note: Most other file systems are supported. If you run Splunk on a filesystem that is not listed above, Splunk may run a startup utility named locktest. Locktest is a program that tests the start up process. If locktest runs and fails, the filesystem is not suitable for running Splunk.

Note: On FreeBSD, mounting as nullfs is not supported.

Storage and performance notes

For some tools for estimating your index size, refer to this topic on the Splunk Wiki.

For more information on ways to reduce your index density, click here

• Was this topic useful?
• Post a comment