Install the Splunk Add-on for Unix and Linux

When you install the Splunk App for Unix and Linux, you automatically install the Splunk Add-on for Unix and Linux.

You install both the Splunk App and Splunk Add-on for Unix and Linux by downloading the installation package from Splunk Apps.

The Splunk Add-on for Unix and Linux installs into $SPLUNK_HOME/etc/apps/Splunk_TA_nix.

Install the Splunk Add-on for Unix and Linux

When you install the add-on onto a universal forwarder, neither Splunk Web nor the CLI is available - you must install it manually. To install the add-on on a universal forwarder:

1. Download the Splunk Add-on for Unix and Linux from Splunk Apps, if you haven't already.

Note: The file downloads with a .zip extension. Do not attempt to run this file.

2. Unpack the splunk_app_for_nix.zip file into $SPLUNK_HOME/etc/apps:

# cd $SPLUNK_HOME
# unzip /path/Splunk_app_for_nix.zip -d $SPLUNK_HOME
etc/apps/splunk_app_for_nix/
...
etc/apps/Splunk_TA_nix/
etc/apps/Splunk_TA_nix/appserver/
etc/apps/Splunk_TA_nix/appserver/controllers/
...
Splunk_TA_nix/samples/sample.fs_notification
Splunk_TA_nix/samples/syslog.nix
#

3. Make sure that the user and group that runs Splunk owns the files.

4. Complete the steps in "Enable data and scripted inputs in the add-on".

Enable data and scripted inputs in the add-on

Once you have installed the Splunk Add-on for Unix and Linux, you must manually enable the inputs that come with it.

To enable the inputs included with the add-on:

1. Make a copy of $SPLUNK_HOME/etc/apps/Splunk_TA_nix/default/inputs.conf and place it into $SPLUNK_HOME/etc/apps/Splunk_TA_nix/local.

Caution: Do not edit the inputs.conf file in $SPLUNK_HOME/etc/apps/Splunk_TA_nix/default. This file gets overwritten whenever you upgrade the app.

2. Open $SPLUNK_HOME/etc/apps/Splunk_TA_nix/local/inputs.conf for editing.

3. Enable the inputs that you want the add-on to monitor by setting the disabled attribute for each input stanza to 0.

4. Save the file.

5. Restart your Splunk instance:

# ./splunk restart