Install the universal forwarder on FreeBSD
Important: Splunk does not offer an installation package for Splunk Enterprise on FreeBSD. There is a universal forwarder installation package for FreeBSD versions 9 and 10.
To use Splunk Enterprise on FreeBSD, you must download an older version of the Splunk software. See the previous releases page.
These instructions install the universal forwarder in the default directory,
/opt does not exist and you have not created it, you might receive an error message. There is no current version of Splunk Enterprise that is available for FreeBSD.
FreeBSD best practices maintain a small root filesystem. You might want to create a symbolic link to another filesystem and install Splunk there, rather than attempting to install in
- Confirm that the
/opt/splunkforwarderdirectories exist. If they do not, create them or link to another file system from there.
- Install the universal forwarder on FreeBSD using the Intel installer:
To install Splunk Enterprise in a different directory:
pkg_add -v -p /usr/splunk splunkforwarder-intel.tgz
Tar file installation
The tar file is a manual form of installation.
These instructions are for installing the universal forwarder tar file only. There is no current version of Splunk Enterprise available for FreeBSD.
When you install the universal forwarder with a tar file:
- Some non-GNU versions of
tarmight not have the
-Cargument available. In this case, if you want to install in
/optor place the tar file in
/optbefore running the
tarcommand. This method will work for any accessible directory on your machine's filesystem.
- The forwarder does not create the
splunkuser automatically. If you want Splunk Enterprise to run as a specific user, you must create the user manually before installing.
- Confirm that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.
Expand the universal forwarder tar file into an appropriate directory using the
tar command. The default install directory is
splunkforwarder in the current working directory.
tar xvzf splunkforwarder.tgz
To install into
tar xvzf splunkforwarder.tgz -C /opt
After you install
To ensure that the forwarder functions properly on FreeBSD, you must perform some additional activities after installation. This includes setting process and virtual memory limits.
The figures below represent a host with 2GB of physical memory. If your host has less than 2 GB of memory, reduce the values accordingly.
- Add the following to
kern.maxdsiz="2147483648" # 2GB kern.dfldsiz="2147483648" # 2GB machdep.hlt_cpus=0
- Add the following to
- Restart FreeBSD for the changes to take effect.
Now that you have installed the Splunk universal forwarder, visit the Universal Forwarder manual to:
Install on Mac OS X
Install the universal forwarder on AIX
This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0