Splunk® Enterprise

Installation Manual

Download manual as PDF

Download topic as PDF

System requirements for use of Splunk Enterprise on-premises

Before you download and install Splunk Enterprise for on-premises use, learn about the computing environments that Splunk supports. See Download Splunk Enterprise for the latest version to download. See the release notes for details on known and resolved issues.

For a discussion of hardware planning for deployment, see Introduction to Capacity Planning for Splunk Enterprise in Capacity Planning.

If you have ideas or requests for new features and you have a current Splunk contract, open a request with Splunk Support.

Supported server hardware architectures

Splunk offers support for 32- and 64-bit architectures on some platforms.

Supported Operating Systems

The following tables list the available computing platforms for Splunk Enterprise. The first table lists availability for *nix operating systems and the second lists availability for Windows operating systems. Use these tables to determine whether or not Splunk Enterprise is available for your platform.

Each table has a series of boxes that define available computing platforms (operating system and architecture) as well as types of Splunk software. A '✔' (check mark) in a box that intersects your computing platform and Splunk software type means that Splunk software is available for that platform and type.

An empty box means that Splunk software is not available for that platform and type.

If you do not see the operating system or architecture that you are looking for in the list, the software is not available for that platform or architecture. This might mean that Splunk has ended support for that platform. See the list of deprecated and removed computing platforms in Deprecated Features in the Release Notes.

Some boxes have other characters. See the bottom of each table to learn what the characters mean and how it could potentially impact your installation.

Confirm support for your computing platform

  1. Find the operating system on which you want to install Splunk Enterprise in the "Operating system" column.
  2. Find the computing architecture in the "Architecture" column that matches your environment.
  3. Find the version of Splunk software that you want to use: Splunk Enterprise, Splunk Free, Splunk Trial, or Splunk Universal Forwarder.
  4. If Splunk software is available for the computing platform and software type that you want, you can proceed to the download page to get it.

Unix operating systems

Operating system Architecture Enterprise Free Trial Universal Forwarder
Solaris 10 and 11 x86 (64-bit) D D D
SPARC
Linux, kernel version 2.6 and later x86 (64-bit)
x86 (32-bit) D
Linux, kernel version 3.x and later x86 (64-bit)
x86 (32-bit) D
PowerLinux, kernel version 2.6 and later PowerPC
zLinux, 2.6 and later s390x
FreeBSD 9 x86 (64-bit)
FreeBSD 10 x86 (64-bit)
Mac OS X 10.10 and 10.11 Intel
AIX 7.1 and 7.2 PowerPC
AIX 6.1 PowerPC D
HP/UX† 11i v3 Itanium
ARM Linux ARM A

A The software for this platform is available for download from splunk.com, but there is no official support for the platform.
D Splunk supports this platform and architecture but might remove support in a future release. See Deprecated Features in the Release Notes for information on deprecation.
† You must use gnu tar to unpack the HP/UX installation archive.

Windows operating systems

The table lists the Windows computing platforms that Splunk Enterprise supports.

Operating system Architecture Enterprise Free Trial Universal Forwarder
Windows Server 2008 R2 x86 (64-bit) D D D D
Windows Server 2012 and Server 2012 R2 x86 (64-bit)
Windows 8, 8.1, and 10 x86 (64-bit)
x86 (32-bit) *** ***

D Splunk supports this platform and architecture but might remove support in a future release. See Deprecated Features in the Release Notes for information on deprecation.
*** Splunk supports but does not recommend using Splunk Enterprise on this platform and architecture.

Operating system notes

Windows

Certain parts of Splunk Enterprise on Windows require elevated user permissions to function properly. See the following topics for information on the components that require elevated permissions and how to configure Splunk Enterprise on Windows:

Operating systems that support the Monitoring Console

The Splunk Enterprise Monitoring Console works only on certain versions of Linux, Solaris, and Windows. For information on supported platform architectures for the Monitoring Console, see Supported platforms in the Troubleshooting Manual. To learn about the other prerequisites for the Monitoring Console, see Monitoring Console setup prerequisites in Monitoring Splunk Enterprise.

Deprecated operating systems and features

As we version the Splunk product, we deprecate and remove support of older operating systems. See Deprecated features in the Release Notes for information on which platforms and features have been deprecated or removed entirely.

Support for some *nix operating systems has ended

With the release of this version of Splunk Enterprise, Splunk has ended support for Splunk Enterprise on FreeBSD, AIX, HP-UX, and 32-bit versions of the Linux kernel. There are still universal forwarder packages available for these platforms, and installation instructions have been updated to install the universal forwarder for those systems:

Creating and editing configuration files on OSes that do not use UTF-8 character set encoding

Splunk Enterprise expects configuration files to be in ASCII or Universal Character Set Transformation Format-8-bit (UTF-8) format. If you edit or create a configuration file on an OS that does not use UTF-8 character set encoding, then ensure that the editor you use can save in ASCII or UTF-8.

IPv6 platform support

All Splunk-supported OS platforms can use IPv6 network configurations except:

  • AIX
  • HP/UX on PA-RISC architecture

See Configure Splunk for IPv6 in the Admin Manual for details on IPv6 support in Splunk Enterprise.

Supported browsers

Splunk Enterprise supports the following browsers:

  • Firefox (latest)
  • Internet Explorer 11
  • Safari (latest)
  • Chrome (latest)

Recommended hardware

To evaluate Splunk Enterprise for a production deployment, use hardware that is typical of your production environment. This hardware should meet or exceed the recommended hardware capacity specifications.

For a discussion of hardware planning for production deployment, see Introduction to capacity planning for Splunk Enterprise in Capacity Planning.

Splunk Enterprise and virtual machines

If you run Splunk Enterprise in a virtual machine (VM) on any platform, performance decreases. This is because virtualization works by providing hardware abstraction on a system into pools of resources. VMs that you define on the system draw from these resource pools. Splunk Enterprise needs sustained access to a number of resources, particularly disk I/O, for indexing operations. If you run Splunk Enterprise in a VM or alongside other VMs, indexing and search performance can degrade.

Recommended hardware capacity

The following requirements are accurate for a single instance installation with light to moderate use. For significant enterprise and distributed deployments, see Capacity Planning.

Platform Recommended hardware capacity/configuration
Non-Windows platforms 2x six-core, 2+ GHz CPU, 12GB RAM, Redundant Array of Independent Disks (RAID) 0 or 1+0, with a 64 bit OS installed.
Windows platforms 2x six-core, 2+ GHz CPU, 12GB RAM, RAID 0 or 1+0, with a 64-bit OS installed.

RAID 0 disk configurations do not provide fault-tolerance. Confirm that a RAID 0 configuration meets your data reliability needs before deploying a Splunk Enterprise indexer on a system configured with RAID 0.

Maintain a minimum of 5GB of free hard disk space on any Splunk Enterprise instance, including forwarders, in addition to the space required for any indexes. See Estimate your storage requirements in Capacity Planning for a procedure on how to estimate the space you need. Failure to maintain this level of free space can degrade performance and cause operating system failure and data loss.

Hardware requirements for universal and light forwarders

The universal forwarder has its own set of hardware requirements. See those requirements in the Universal Forwarder manual.

Supported file systems

If you run Splunk Enterprise on a file system that does not appear in this table, the software might run a startup utility named locktest to test the viability of the file system. If locktest fails, then the file system is not suitable for using with Splunk Enterprise.

Platform File systems
Linux ext2, ext3, ext4, btrfs, XFS, NFS 3/4
Solaris UFS, ZFS, VXFS, NFS 3/4
FreeBSD FFS, UFS, NFS 3/4, ZFS
Mac OS X HFS, NFS 3/4
AIX JFS, JFS2, NFS 3/4
HP-UX VXFS, NFS 3/4
Windows NTFS, FAT32

Considerations regarding Network File System (NFS)

When you use Network File System (NFS) as a storage medium for Splunk indexing, consider all of the ramifications of file level storage.

Use block level storage rather than file level storage for indexing your data.

In environments with reliable, high-bandwidth, low-latency links, or with vendors that provide high-availability, clustered network storage, NFS can be an appropriate choice. However, customers who choose this strategy should work with their hardware vendor to confirm that their storage platform operates to the vendor specification in terms of both performance and data integrity.

If you use NFS, note the following:

  • Do not use NFS to host hot or warm index buckets as a failure in NFS can cause data loss. NFS works best with cold or frozen buckets.
  • Do not use NFS to share cold or frozen index buckets amongst an indexer cluster, as this potentially creates a single point of failure.
  • Splunk Enterprise does not support "soft" NFS mounts. These are mounts that cause a program attempting a file operation on the mount to report an error and continue in case of a failure.
  • Only "hard" NFS mounts (mounts where the client continues to attempt to contact the server in case of a failure) are reliable with Splunk Enterprise.
  • Do not disable attribute caching. If you have other applications that require disabling or reducing attribute caching, then you must provide Splunk Enterprise with a separate mount with attribute caching enabled.
  • Do not use NFS mounts over a wide area network (WAN). Doing so causes performance issues and can lead to data loss.

Considerations regarding system-wide resource limits on *nix systems

Splunk Enterprise allocates system-wide resources like file descriptors and user processes on *nix systems for monitoring, forwarding, deploying, searching, and other things. The ulimit command controls access to these resources which must be set to acceptable levels for Splunk Enterprise to function properly on *nix systems.

The more tasks your Splunk Enterprise instance performs, the more resources it needs. You should increase the ulimit values if you start to see your instance run into problems with low resource limits. See I get errors about ulimit in splunkd.log in the Troubleshooting Manual.

The following table shows the system-wide resources that the software uses. It provides the minimum recommended settings for these resources for instances that are not forwarders (such as indexers, search heads, cluster masters, license masters, deployment servers, and Monitoring Consoles (MC)).

System-wide Resource ulimit invocation Recommended min. value
Open files ulimit -n 8192
User processes ulimit -u 1024
Data segment size ulimit -d 1073741824

On hosts that run FreeBSD, you might need to increase the kernel parameters for default and maximum process stack size. The following table shows the parameters that must be present in /boot/loader.conf on the host.

System-wide Resource Kernel parameter Recommended value
Default process data size (soft limit) dfldsiz 2147483648
Maximum process data size (hard limit) maxdsiz 2147483648

This consideration is not applicable to Windows-based systems.

Considerations regarding solid state drives

Solid state drives (SSDs) deliver significant performance gains over conventional hard drives for Splunk in "rare" searches - searches that request small sets of results over large swaths of data - when used in combination with bloom filters. They also deliver performance gains with concurrent searches overall.

Considerations regarding Common Internet File System (CIFS)/Server Message Block (SMB)

Splunk Enterprise supports the use of the CIFS/SMB protocol for the following purposes, on shares hosted by Windows hosts only:

When you use a CIFS resource for storage, confirm that the resource has write permissions for the user that connects to the resource at both the file and share levels. If you use a third-party storage device, confirm that its implementation of CIFS is compatible with the implementation that your Splunk Enterprise instance runs as a client.

Do not index data to a mapped network drive on Windows (for example "Y:\" mapped to an external share.) Splunk Enterprise disables any index it encounters with a non-physical drive letter.

Considerations regarding environments that use the transparent huge pages memory management scheme

If you run a Unix environment that makes use of transparent huge memory pages, see Transparent huge memory pages and Splunk performance before you attempt to install Splunk Enterprise.

This consideration is not applicable to Windows operating systems.

PREVIOUS
Installation overview
  NEXT
Splunk Enterprise architecture and processes

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1


Comments

Hi Hcpr,

We can't comment on specific release dates, but rest assured that we are working on a version of the universal forwarder that will be officially supported on Windows Server 2016.

While it is not officially supported, you can run the current version of the universal forwarder on a Windows Server 2016 machine.

Malmoore, Splunker
November 17, 2016

When will Universal Forwarder for Windows Server 2016 be availible?

Hcpr
November 16, 2016

It is un-clear if Splunk 6.5 is supported on Linux distributions with kernel versions 4.x or later.

Pgreer splunk, Splunker
November 14, 2016

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters