Install on FreeBSD
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Install on FreeBSD
The FreeBSD builds comes in two forms: an installer (5.4-intel) and a tarball (i386). Both are gzipped tarball (.tgz) files.
For FreeBSD 8 , Splunk requires compatibility packages. To install the compatibility package:
1. Install the port:
portsnap fetch update
cd /usr/ports/misc/compat7x/ && make install clean
2. Add the package:
pkg_add -r compat7x-amd64
To install FreeBSD using the intel installer:
Important: This installs Splunk in the default directory,
/opt does not exist, you will need to create it prior to running the install command. If you don't, you might receive an error message. Splunk recommends that you create a symbolic link to another filesystem and install Splunk there, since best practices for FreeBSD maintain a small root ("
To install Splunk in a different directory:
pkg_add -v -p /usr/splunk splunk_package_name-6.1-intel.tgz
The FreeBSD package system does not have native upgrade support. There are some add-on utilities which try to manage it, but this is not explicitly tested. To upgrade a package on FreeBSD you can either uninstall the prior package, and install the new package, or you can upgrade the existing installation using a tarball install as below.
To install Splunk on a FreeBSD system, expand the tarball into an appropriate directory using the
tar xvzf splunk_package_name.tgz
The default install directory is
splunk in the current working directory. To install into
/opt/splunk, use the following command:
tar xvzf splunk_package_name.tgz -C /opt
Note: When you install Splunk with a tarball:
- Some non-GNU versions of
tarmight not have the
-Cargument available. In this case, if you want to install in
/optor place the tarball in
/optbefore running the
tarcommand. This method will work for any accessible directory on your machine's filesystem.
- Splunk does not create the
splunkuser automatically. If you want Splunk to run as a specific user, you must create the user manually before installing.
- Ensure that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.
After you install
To ensure that Splunk functions properly on FreeBSD, you must:
1. Add the following to
kern.maxdsiz="2147483648" # 2GB kern.dfldsiz="2147483648" # 2GB machdep.hlt_cpus=0
2. Add the following to
A restart of the OS is required for the changes to effect.
If your server has less than 2 GB of memory, reduce the values accordingly.
What gets installed
To see the list of Splunk packages:
pkg_info -L splunk
To list all packages:
Splunk can run as any user on the local system. If you run Splunk as a non-root user, make sure that Splunk has the appropriate permissions to read the inputs that you specify.
To start Splunk from the command line interface, run the following command from
$SPLUNK_HOME/bin directory (where $SPLUNK_HOME is the directory into which you installed Splunk):
By convention, this document uses:
$SPLUNK_HOMEto identify the path to your Splunk installation.
$SPLUNK_HOME/bin/to indicate the location of the command line interface.
The first time you start Splunk after a new installation, you must accept the license agreement. To start Splunk and accept the license in one step:
$SPLUNK_HOME/bin/splunk start --accept-license
Note: There are two dashes before the
Launch Splunk Web and log in
After you start Splunk and accept the license agreement,1. In a browser window, access Splunk Web at
hostnameis the host machine.
portis the port you specified during the installation (the default port is 8000).
2. Splunk Web prompts you for login information (default, username
admin and password
changeme) before it launches. If you switch to Splunk Free, you will bypass this logon page in future sessions.
Now that you've installed Splunk, what comes next?
Manage your license
If you are performing a new installation of Splunk or switching from one license type to another, you must install or update your license.
Use your local package management commands to uninstall Splunk. In most cases, files that were not originally installed by the package will be retained. These files include your configuration and index files which are under your installation directory.
To uninstall Splunk from the default location:
To uninstall Splunk from a different location:
pkg_delete -p /usr/splunk splunk