Splunk® Add-on for Unix and Linux

Deploy and Use the Splunk Add-on for Unix and Linux

Download manual as PDF

Download topic as PDF

Platform and hardware requirements

Hardware and operating system requirements

The Splunk Add-on for Unix and Linux installs on Splunk instances that run on many versions of Unix, including Linux, Solaris, AIX, and HP/UX.

Distributed installation of this add-on

This table provides a reference for installing the add-on onto a distributed deployment of Splunk Enterprise.

Splunk instance type Supported Required Comments
Search Heads Yes Yes If you want *nix data from a host that acts as a search head, install the add-on there. The host must run a supported version of *nix. You can configure the add-on through Splunk Web or the setup.sh command line interface. If you install splunk_TA_nix on forwarders, you must also install it on the search heads on which you have installed splunk_app_for_nix.
Indexers Yes Yes The host must run a supported version of *nix. You can configure the add-on through Splunk Web or the setup.sh command line interface. If you install splunk_TA_nix on forwarders, you must also install it on the indexers on which you have installed splunk_app_for_nix.
Heavy Forwarders Yes No The host must run a supported version of *nix.
Universal Forwarders Yes Yes You must install the add-on into a universal forwarder on a host to get data from that host. The host must run a supported version of *nix. You must perform all configuration through the setup.sh command line interface.
Light Forwarders Yes No The host must run a supported version of *nix.

Distributed deployment compatibility

This table provides a quick reference for the compatibility of this add-on with Splunk distributed deployment features.

Distributed deployment feature Supported Comments
Search Head Clusters Yes
Indexer Clusters Yes To get data from an indexer cluster member, install the add-on into that member.
Deployment Server Yes You can deploy the add-on to indexers, forwarders, and search heads.

Official support

The Splunk Add-on for Unix and Linux supports most versions of *nix that appear in the Unix operating systems section of the Splunk Enterprise Installation Manual. Here is the list of the exceptions: Solaris 10, Solaris 11 and RHEL 7.

What other items does the add-on require?

The Splunk Add-on for Unix and Linux requires the sysstat software package to function properly. You can download the sysstat utilities from the sysstat utilities download page or from your local package repository (depending on the version of *nix your host runs.)

What versions of Splunk do the app and add-on support?

All instances of Splunk Enterprise in a Splunk for Unix and Linux deployment must run version 5.0 or later.

Download the correct version for your architecture and platform.

PREVIOUS
How to get support and find more information about Splunk
  NEXT
What data the Splunk Add-on for Unix and Linux collects

This documentation applies to the following versions of Splunk® Add-on for Unix and Linux: 5.1.0, 5.1.1, 5.1.2, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4


Comments

Hello DUThibault--
Thanks for your comment about the install detail. I have updated the table to add this information. Many thanks.

Jrevell splunk, Splunker
October 19, 2017

"Distributed installation of this add-on" is incorrect: if you install the Add-on (Splunk_TA_nix) on forwarders, you must ALSO install it on the search heads and indexers where splunk_app_for_nix is installed. See https://answers.splunk.com/answers/521110/how-to-install-the-splunk-add-on-for-unix-and-linu.html#answer-574598

DUThibault
September 15, 2017

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters