Install on Linux
You can install Splunk on Linux using RPM or DEB packages, or a tarball.
Install from a RedHat RPM
To install the Splunk RPM in the default directory
rpm -i splunk_package_name.rpm
To install Splunk in a different directory, use the
rpm -i --prefix=/opt/new_directory splunk_package_name.rpm
To upgrade an existing Splunk installation that resides in /opt/splunk using the RPM:
rpm -U splunk_package_name.rpm
To upgrade an existing Splunk installation that was done in a different directory, use the
rpm -U --prefix=/opt/existing_directory splunk_package_name.rpm
Note: If you do not specify with
--prefix for your existing directory, rpm will install in the default location of
For example, to upgrade to the existing directory of
$SPLUNK_HOME=/opt/apps/splunk enter the following:
rpm -U --prefix=/opt/apps splunk_package_name.rpm
If you want to automate your RPM install with kickstart, add the following to your kickstart file:
./splunk start --accept-license ./splunk enable boot-start
Note: The second line is optional for the kickstart file.
Install from a Debian DEB package
To install the Splunk DEB package:
dpkg -i splunk_package_name.deb
Note: You can only install the Splunk DEB package in the default location,
What gets installed
Splunk package status:
dpkg --status splunk
List all packages:
Install from a tarball
To install Splunk on a Linux system, expand the tarball into an appropriate directory using the
tar xvzf splunk_package_name.tgz
The default install directory is
splunk in the current working directory. To install into
/opt/splunk, use the following command:
tar xvzf splunk_package_name.tgz -C /opt
Note: When you install Splunk with a tarball:
- Some non-GNU versions of
tarmight not have the
-Cargument available. In this case, if you want to install in
/optor place the tarball in
/optbefore running the
tarcommand. This method will work for any accessible directory on your machine's filesystem.
- Splunk does not create the
splunkuser automatically. If you want Splunk to run as a specific user, you must create the user manually before installing.
- Ensure that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.
Splunk can run as any user on the local system. If you run Splunk as a non-root user, make sure that Splunk has the appropriate permissions to read the inputs that you specify. Refer to the instructions for running Splunk as a non-root user for more information.
To start Splunk from the command line interface, run the following command from
$SPLUNK_HOME/bin directory (where $SPLUNK_HOME is the directory into which you installed Splunk):
By convention, this document uses:
$SPLUNK_HOMEto identify the path to your Splunk installation.
$SPLUNK_HOME/bin/to indicate the location of the command line interface.
The first time you start Splunk after a new installation, you must accept the license agreement. To start Splunk and accept the license in one step:
$SPLUNK_HOME/bin/splunk start --accept-license
Note: There are two dashes before the
Launch Splunk Web and log in
After you start Splunk and accept the license agreement,
1. In a browser window, access Splunk Web at
hostnameis the host machine.
portis the port you specified during the installation (the default port is 8000).
2. Splunk Web prompts you for login information (default, username
admin and password
changeme) before it launches. If you switch to Splunk Free, you will bypass this logon page in future sessions.
Now that you've installed Splunk, what comes next?
Use your local package management commands to uninstall Splunk. In most cases, files that were not originally installed by the package will be retained. These files include your configuration and index files which are under your installation directory.
If you can't use package management commands, follow the instructions for manually uninstalling Splunk components.
To uninstall from RedHat Linux
rpm -e splunk_product_name
To uninstall from Debian Linux:
dpkg -r splunk
To purge (delete everything, including configuration files):
dpkg -P splunk
Install on Windows via the command line
Install on Solaris
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7