Install the universal forwarder on FreeBSD

Important: Splunk does not offer an installation package for Splunk Enterprise on FreeBSD. There is a universal forwarder installation package for FreeBSD versions 9 and 10.

To use Splunk Enterprise on FreeBSD, you must download an older version of the Splunk software. See the previous releases page.

Basic installation

These instructions install the universal forwarder in the default directory, /opt/splunkforwarder. If /opt does not exist and you have not created it, you might receive an error message. There is no current version of Splunk Enterprise that is available for FreeBSD.

FreeBSD best practices maintain a small root filesystem. You might want to create a symbolic link to another filesystem and install Splunk there, rather than attempting to install in /opt.

1. Confirm that the /opt/splunkforwarder directories exist. If they do not, create them or link to another file system from there.
2. Install the universal forwarder on FreeBSD using the Intel installer:

   pkg_add splunkforwarder-intel.tgz
   

   To install Splunk Enterprise in a different directory:

   pkg_add -v -p /usr/splunk splunkforwarder-intel.tgz
   

Tar file installation

The tar file is a manual form of installation.

These instructions are for installing the universal forwarder tar file only. There is no current version of Splunk Enterprise available for FreeBSD.

When you install the universal forwarder with a tar file:

• Some non-GNU versions of tar might not have the -C argument available. In this case, if you want to install in /opt/splunkforwarder, either cd to /opt or place the tar file in /opt before running the tar command. This method will work for any accessible directory on your machine's filesystem.
• The forwarder does not create the splunk user automatically. If you want Splunk Enterprise to run as a specific user, you must create the user manually before installing.
• Confirm that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.

Expand the universal forwarder tar file into an appropriate directory using the tar command. The default install directory is splunkforwarder in the current working directory.

tar xvzf splunkforwarder.tgz

To install into /opt/splunkforwarder, execute:

tar xvzf splunkforwarder.tgz -C /opt

After you install

To ensure that the forwarder functions properly on FreeBSD, you must perform some additional activities after installation. This includes setting process and virtual memory limits.

The figures below represent a host with 2GB of physical memory. If your host has less than 2 GB of memory, reduce the values accordingly.

1. Add the following to /boot/loader.conf

   kern.maxdsiz="2147483648" # 2GB
   kern.dfldsiz="2147483648" # 2GB
   machdep.hlt_cpus=0 
   

2. Add the following to /etc/sysctl.conf:

   vm.max_proc_mmap=2147483647
   

3. Restart FreeBSD for the changes to take effect.

Next steps

Now that you have installed the Splunk universal forwarder, visit the Universal Forwarder manual to:

• Learn how to configure it to get and forward data.
• Configure it to start at boot time. See Configure Splunk software to start at boot time.
• Learn the what commands you can issue to it.