Splunk® Enterprise

Installation Manual

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Install on Solaris

You can install Splunk Enterprise on Solaris with a PKG packages, or a tar file.

To install the Splunk universal forwarder, see Install a *nix universal forwarder in the Universal Forwarder manual. The universal forwarder is a separate executable, with its own set of installation procedures.


If you are upgrading, see How to upgrade Splunk for instructions and migration considerations before proceeding.

Install Splunk

Splunk Enterprise for Solaris is available as a PKG file or a tar file.

PKG file install

The PKG installation package includes a request file that prompts you to answer a few questions before Splunk installs.

pkgadd -d ./splunk_product_name.pkg

A list of the available packages is displayed.

  • Select the packages you wish to process (the default is "all").

The installer then prompts you to specify a base installation directory.

  • To install into the default directory, /opt/splunk, leave this blank.

Caveat for software package validation when using PKG files for installation

After installation, software package validation commands (such as pkg verify might fail because of intermediate files that get deleted during the installation process. To verify your Splunk installation package, use the splunk validate files CLI command instead.

tar file install

The tar file is a manual form of installation. When you install Splunk Enterprise with a tar file:

  • Some non-GNU versions of tar might not have the -C argument available. In this case, if you want to install in /opt/splunk, either cd to /opt or place the tar file in /opt before running the tar command. This method will work for any accessible directory on your machine's filesystem.
  • If the gzip binary is not present on your system, you can use the uncompress command instead.
  • Splunk Enterprise does not create the splunk user automatically. If you want it to run as a specific user, you must create the user manually before installing.
  • Ensure that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.

To install Splunk Enterprise on a Solaris system, expand the tar file into an appropriate directory using the tar command:

tar xvzf splunk_package_name.tar.Z

The default install directory is splunk in the current working directory. To install into /opt/splunk, use the following command:

tar xvzf splunk_package_name.tar.Z -C /opt

What gets installed

To learn more about the Splunk Enterprise package and what it installs, run the following command:

pkginfo -l splunk

To list all packages that have been installed on the host:


Next steps

Now that you have installed Splunk Enterprise:

Uninstall Splunk Enterprise

To learn how to uninstall Splunk Enterprise, see Uninstall Splunk Enterprise in this manual.

Last modified on 10 November, 2017
Install on Linux
Install on Mac OS X

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters