System requirements

System requirements

Before you download and install the Splunk software, read the following sections for the supported system requirements. If you have ideas or requests for new features to add to future releases, email Splunk Support. Also, you can follow our Product Roadmap.

Refer to the download page for the latest version to download. Check the release notes for details on known and resolved issues.

For a discussion of hardware planning for deployment, check out the topic on capacity planning in this manual.

Supported OSes

Splunk is supported on the following platforms.

• Solaris 9, 10 (x86, SPARC)
• Linux Kernel vers 2.6.x and above (x86: 32 and 64-bit)
• FreeBSD 6.1 and 6.2 (x86: 32 and 64-bit)
• Windows 2003 (64-bit, supported but not recommended on 32-bit)
• Windows 2008 (64-bit, supported but not recommended on 32-bit)
• WindowsXP (32-bit)
• Vista (32-bit, 64-bit)
• Windows 7 (32-bit, 64-bit)
• MacOSX 10.5 and 10.6 (32-bit & 64bit in one download, 10.6 is only supported in 32-bit mode)
• AIX 5.2 and 5.3
• HP-UX 11iv2 (11.22) and 11iv3 (11.31) (PA-RISC or Itanium, gnu tar is required to unpack the tar.gz archive)

FreeBSD 7.x

To run Splunk 4.x on 32-bit FreeBSD 7.x, install the compat6x libraries. Splunk Support will supply "best effort" support for users running on FreeBSD 7.x. For more information, refer to this Community wiki topic.

Fedora Core 13

Users of Fedora Core 13 must be sure to update glibc to 2.12-2 or higher (released 2010-06-07) to resolve a glibc memory allocator bug - https://bugzilla.redhat.com/show_bug.cgi?id=594784 The symptom of the glibc-2.12-1 problem are program crashes with the message 'invalid fastbin entry (free)'. This is only expected to affect the 32 bit splunk build, but as it will likely cause crashes in system tools as well, the update is recommended for all Fedora Core 13 splunk users, 32bit and 64bit.

Creating and editing configuration files on non-UTF-8 OSes

Splunk expects configuration files to be in ASCII/UTF-8. If you are editing or creating a configuration file on an OS that is non-UTF-8, you must ensure that the editor you are using is configured to save in ASCII/UTF-8.

Supported browsers

• Firefox 2 and 3.0.x
• Firefox 3.5 (with Splunk version 4.0.6 and later)
• Internet Explorer 6, 7 and 8
• Safari 3

Recommended hardware

Splunk is a high-performance application. If you are performing a comprehensive evaluation of Splunk for production deployment, we recommend that you use hardware typical of your production environment; this hardware should meet or exceed the recommended hardware capacity specifications below.

For a discussion of hardware planning for production deployment, check out the topic on capacity planning in this manual.

Note: Running Splunk in virtual machine (VM) mode on any platform will degrade performance.

Recommended and minimum hardware capacity

Platform	Recommended hardware capacity/configuration	Minimum supported hardware capacity
Non-Windows platforms	2x quad-core Xeon, 3GHz, 8GB RAM, RAID 1+0 or 0, with a 64 bit OS installed.	1x1.4 GHz CPU, 1 GB RAM
Windows platforms	2x quad-core Xeon, 3GHz, 8GB RAM, RAID 1+0 or 0, with a 64 bit OS installed.	Pentium 4 or equivalent at 2Ghz, 2GB RAM

Note: Be certain that your data reliability needs are met by a RAID 0 configuration before deploying a Splunk indexer on RAID 0.

• All configurations other than Splunk light forwarder instances require at least the recommended hardware configuration.
• The minimum supported hardware guidelines are designed for personal use of Splunk.

Important: For all installations including forwarders, a minimum of 2GB hard disk space for your Splunk installation is required in addition to the space required for your index. Refer to this topic on estimating your index size requirements in this manual for some planning information.

Hardware requirements for Splunk light forwarders

Recommended	Dual Core 1.5Ghz+ processor, 1GB+ RAM
Minimum	1.0 Ghz processor, 512MB RAM

Supported file systems

Platform	File systems
Linux	ext2/3, reiser3, XFS, NFS 3/4
Solaris	UFS, ZFS, VXFS, NFS 3/4
FreeBSD	FFS, UFS, NFS 3/4
Mac OS X	HFS, NFS 3/4
AIX	JFS, JFS2, NFS 3/4
HP-UX	VXFS, NFS 3/4
Windows	NTFS, FAT32

Considerations regarding NFS

NFS is usually a poor choice for Splunk indexing activity, for reasons of performance, resilience, and semantics. In environments with very high bandwidth, very low latency links, that are kept highly reliable, it can be an appropriate choice. Typically, this is a SAN accessed via the NFS protocol.

Note: When indexing to NFS, attribute cache must remain enabled for reasonable performance. For example, on Linux actimeo=0 or noac must not be used in the mount options. This will also have some impact on tailing performance.

Note: Several other file systems are supported. If you run Splunk on a filesystem that is not listed above, Splunk may run a startup utility named locktest. Locktest is a program that tests the start up process. If locktest runs and fails, the filesystem is not suitable for running Splunk.

Note: On FreeBSD, mounting as nullfs is not supported.

Supported server hardware architectures

32 and 64-bit architectures are supported for some platforms. See the download page page for details.

• Was this topic useful?
• Post a comment