About the Splunk Enterprise AMI

Splunk Enterprise is available as an Amazon Machine Image on the Amazon Web Services Marketplace.

What is the Splunk Enterprise AMI?

The Splunk Enterprise AMI is an Amazon Machine Image consisting of Splunk Enterprise running on Amazon Linux.

The image includes a Splunk Enterprise Trial license. To learn about the license features and time limits, see Types of Splunk Enterprise licenses.

Get the Splunk Enterprise AMI with 1-click

1. From the AWS Marketplace, select Splunk Enterprise AMI.
2. On the overview tab, select "Continue to subscribe."
3. Once the subscription authorization is complete, select "Continue to Configuration."
4. Confirm Splunk Enterprise version and the region selected. Select "Continue to Launch."
5. On the Launch this software page:
   1. Choose an EC2 instance type. Select an instance type with sufficient storage and resources to support your use-case. See Introduction to capacity planning for Splunk Enterprise in the Capacity Planning Manual for more information.
   2. In "Security Group Settings" select a security group.
   3. In "Key Pair Settings" select or create a key pair.
6. Select "Launch"
7. Make note of the ports that are opened in your chosen security group. The typical ports are: 8089 (Splunk Enterprise Management), 8000 (Splunk Web), 9997 (Splunk Forwarder listener), 22 (SSH), and 443 (SSL/HTTPS). For more information about open ports and security, see About securing Splunk software and How to secure and harden your Splunk software installation in Securing Splunk Enterprise.

Start using the Splunk Enterprise AMI

If you've already started a copy of the Splunk Enterprise AMI on the AWS Marketplace, then you'll have an instance of Splunk Enterprise running as the Splunk user. The Splunk Enterprise services will start when the machine starts.

Find Splunk Web

1. In your EC2 Management Console, find your instance running Splunk Enterprise. Note the instance ID and public IP address.
2. Paste the public IP into a new browser tab. Do not hit enter yet.
   1. Append the Splunk Web port to the end of the IP address. Example: http://$aws_public_ip:8000
   2. Hit enter.
3. Log into Splunk Enterprise with the default AMI credentials:
   1. For Splunk Enterprise version 7.2.5 and later:
      1. username: admin
      2. password: SPLUNK-$instance id$
      3. It is recommended that you change your password after login.
   2. For older Splunk Enterprise versions:
      1. username: admin
      2. password: $instance id$
      3. On the next screen, set a new password.

Next tasks

• Learn how to run simple searches and generate reports from data in Splunk Enterprise by following along with the Search Tutorial.
• Learn how to access your AMI instance file system using SSH in the Connect to your Linux instance at the Amazon Elastic Compute Cloud documentation.
• Learn about Splunk Enterprise knowledge objects in the Knowledge Manager Manual.
• For an overview of tasks in Splunk Enterprise and where you can find more information about them, see Splunk administration: the big picture in the Admin Manual .

Upgrade

Upgrade Splunk Enterprise version

See "How to upgrade Splunk" in the Installation Manual. Be sure to run a backup before you begin the upgrade.

Upgrade your AWS storage capacity

See the AWS documentation about Amazon EBS.

Upgrade your AWS compute capacity

See the AWS documentation about Amazon EC2.

Get help

To find community resources and get help, see Get Started with Splunk Community. To purchase a Splunk Enterprise license and support, contact sales@splunk.com.