Start Splunk for the first time
To start Splunk:
You can start Splunk on Windows using either the command line, or the Windows Services Manager. Using the command line offers more options, described later in this section. In a
cmd window, go to
C:\Program Files\Splunk\bin and type:
(For Windows users: in subsequent examples and information, replace
C:\Program Files\Splunk if you have installed Splunk in the default location. You can also add
%SPLUNK_HOME% as a system-wide environment variable by using the System Properties dialog's Advanced tab.)
Use the Splunk command-line interface (CLI):
Splunk then displays the license agreement and prompts you to accept before the startup sequence continues.
Other start options
To accept the license automatically when you start Splunk for the first time, add the
accept-license option to the
$SPLUNK_HOME/bin/splunk start --accept-license
The startup sequence displays:
Checking prerequisites... Checking http port : open Checking mgmt port : open Verifying configuration. This may take a while... Finished verifying configuration. Checking index directory... Verifying databases... Verified databases: _audit, _blocksignature, _internal, _thefishbucket, history, main, sampledata, splunklogger, summary Checking index files All index checks passed. All preliminary checks passed. Starting splunkd... Starting splunkweb... Splunk Server started. The Splunk web interface is at http://<hostname>:8000
Note: If the default ports are already in use (or are otherwise not available), Splunk will offer to use the next available port. You can either accept this option or specify a port for Splunk to use.
There are two other
- If you run
$SPLUNK_HOME/bin/splunk start --no-prompt, Splunk proceeds with startup until it requires you to answer a question. Then, it displays the question, why it is quitting, and quits.
- If you run
SPLUNK_HOME/bin/splunk start --answer-yes, Splunk proceeds with startup and automatically answers "yes" to all yes/no questions. Splunk displays the question and answer as it continues.
If you run start with all three options in one line, for example:
$SPLUNK_HOME/bin/splunk start --answer-yes --no-prompt --accept-license
- Splunk does not ask you to accept the license.
- Splunk answers yes to any yes/no question.
- Splunk quits when it encounters a non-yes/no question.
Start and disable individual processes
You can start and stop individual Splunk processes by adding the process as an object to the
start command. The objects include:
splunkd, the Splunk server daemon.
splunkweb, Splunk's Web interface process.
For example, to start only
$SPLUNK_HOME/bin/splunk start splunkd
$SPLUNK_HOME/bin/splunk disable webserver
For more information about
start, refer to the CLI help page:
$SPLUNK_HOME/bin/splunk help start
Launch Splunk Web
Use whatever host and port you chose during installation.
The first time you log in to Splunk Enterprise, the default login details are:
Username - admin
Password - changeme
Splunk Free does not have access controls.
Install a license
About upgrading to 4.3 READ THIS FIRST
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7