Splunk® Data Stream Processor

Install and administer the Data Stream Processor

Acrobat logo Download manual as PDF


On April 3, 2023, Splunk Data Stream Processor will reach its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Hardware and Software Requirements

The Data Stream Processor officially supports the following hardware and software versions.

Forwarders versions

The Data Stream Processor 1.0.0 officially supports Splunk Forwarders 7.1.0 to 8.0.1.

Browser versions

The Data Stream Processor 1.0.0 officially supports these browsers:

  • Chrome 77.0 and above
  • Safari (latest)
  • Firefox (latest)
  • Microsoft Edge 12 and above

Operating system versions

The Data Stream Processor 1.0.0 officially supports the following Linux Operating Systems.

  • Red Hat: 7.x and 8.0
  • Centos: 7.x
  • Ubuntu: 18.04

Splunk Enterprise versions

The Data Stream Processor 1.0.0 officially supports sending data to Splunk Enterprise 7.1.0+ instances hosted on Linux.

Hardware Requirements

Your clustered deployment must have a minimum of three nodes with each node having the following specifications. We recommend having five nodes for high availability.

Hardware Specifications
CPU cores Minimum: 8 physical cores or 16 vCPUs

Recommended: 16 physical cores or 32 vCPUs

Network speed 10 Gb/s or higher
Memory 64 GB, 128 GB recommended
Storage Enough disk space in /var/lib/gravity to support 24 hours of data retention. 1 TB of storage recommended. This is where Gravity stores containers and state information. You can change where Gravity stores this information at install-time. See the Extract and run the Data Stream Processor installer section on the Install the Data Stream Processor topic for more information.

To reduce the latency of communication between DSP components, all nodes in the DSP cluster should be interconnected via a low-latency network. For example, in cloud deployments, components must be placed in the same region. While nodes may span availability zones, DSP does not currently guarantee services will be effectively deployed.

Last modified on 01 June, 2020
PREVIOUS
Installation checklist for DSP
  NEXT
Install the Data Stream Processor

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters