Splunk® Enterprise

Installation Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Information on Windows third-party binaries distributed with Splunk

This topic provides additional information on the third-party Windows binaries that the Splunk Enterprise and the Splunk universal forwarder packages include.

For more information about Splunk's universal forwarder, read "Deploy the universal forwarder" in the Distributed Deployment Manual.

Third-party Windows binaries included with Splunk

The following third-party Windows binaries ship with the Splunk product. Except where indicated, only the Splunk Enterprise product includes these binaries.

These binaries provide functionality to Splunk as shown in their individual descriptions. None of them contains file version information or authenticode signatures (certificates which prove the binary file's authenticity). Additionally, Splunk does not provide support for debug symbols related to third-party modules.

Note: Only the third party binaries, apps and scripts that ship with Splunk have been tested for Certified for Windows Server 2008 R2 (CFW2008R2) Windows Logo compliance. Any other binaries, apps, or scripts - such as those you download from the Internet in the course of extending Splunk's capabilities - have not been tested for this compliance.


Libarchive.dll is a multi-format archive and compression library.

Both Splunk Enterprise and the Splunk universal forwarder include this binary.


Bzip2 is a freely available, patent-free (see below), high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.


Jsmin.exe is an executable that removes whitespace and comments from JavaScript files, reducing their size.


Libexslt.dll is the Extensions to Extensible Stylesheet Language Transformation (EXSLT) dynamic link C library developed for libxslt (a part of the GNOME project).

Both Splunk Enterprise and the Splunk universal forwarder include this binary.


Libxml2.dll is the Extensible Markup Language (XML) C parser and toolkit developed for the GNOME project (but usable outside of the GNOME platform),

Both Splunk Enterprise and the Splunk universal forwarder include this binary.


Libxslt.dll is the XML Stylesheet Language for Transformations (XSLT) dynamic link C library developed for the GNOME project. XSLT itself is an XML language to define transformation for XML. Libxslt is based on libxml2 the XML C library developed for the GNOME project. It also implements most of the EXSLT set of processor-portable extensions functions and some of Saxon's evaluate and expressions extensions.

Both Splunk Enterprise and the Splunk universal forwarder include this binary.


Minigzip.exe is the minimal implementation of the ’gzip’ compression tool.


The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and open source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.

Both Splunk Enterprise and the Splunk universal forwarder include this binary.


Python.exe is the Python programming language binary for Windows.


Pythoncom.dll is a module that encapsulates the Object Linking and Embedding (OLE) automation API for Python.


Pywintypes27.dll is a module that encapsulates Windows types for Python version 2.7.

Splunk architecture and processes
Step-by-step installation instructions

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters