Platform and hardware requirements

This topic discusses the underlying requirements for running both the Splunk App and the Splunk Add-on for Unix and Linux.

What versions of Splunk Enterprise does the app support?

The Splunk App for Unix and Linux supports the following versions of Splunk Enterprise:

• Splunk Enterprise 5.0.0 and later.
• Splunk Enterprise 6.0.0 and later.
• Splunk Enterprise 6.1.0 and later.
• Splunk Enterprise 6.2.0 and later.
• Splunk Enterprise 6.3.0 and later.

All instances of Splunk Enterprise in a Splunk App for Unix and Linux deployment must run version 5.0.0 or later.

Distributed installation of this app

This table provides a quick reference for installing this app onto a distributed deployment of Splunk Enterprise.

Splunk instance type	Supported	Required	Comments
Search Heads	Yes	Yes	Install this app onto all search heads where you require knowledge management.
Indexers	Yes	Depends	The Splunk App for Unix and Linux does not require installation on indexers except in the case where you forward search head data to those indexers. If that is true, you must install the SA-Nix component of the app onto those indexers. If you want to collect *nix data from those indexers, you must install the Splunk Add-on for Unix and Linux (Splunk_TA_nix) component onto the indexers as well.
Heavy Forwarders	Yes	No	The Splunk App for Unix and Linux does not do anything when you install it on a heavy forwarder unless that forwarder is also a search head. If you want to collect *nix data from the HF, you must also install the Splunk Add-on for Unix and Linux (Splunk_TA_nix) component.
Universal Forwarders	No	No	Use universal forwarders to get the data you need for the app. While the app does nothing when you install it on a universal forwarder, you can install the Splunk Add-on for Unix and Linux (Splunk_TA_nix) component on forwarders and send data to the Splunk App for Unix and Linux indexers.
Light Forwarders	No	No	You can use light forwarders to send data to indexers for the app, but remember that: Light forwarders have been deprecated and could be removed in a future version of Splunk Enterprise. Universal forwarders have better performance than light forwarders.

Distributed deployment compatibility

This table provides a quick reference for the compatibility of this add-on with Splunk distributed deployment features.

Distributed deployment feature	Supported	Comments
Search Head Clusters	Yes	You can install this app on a search head cluster. Follow the procedures that this manual outlines to get the data for the app, then install the app on the cluster. Install the Splunk App for Unix and Linux on a search head cluster
Indexer Clusters	Yes	Before you start the Splunk App for Unix and Linux installation, configure your indexer cluster.
Deployment Server	Yes	You can use a deployment server to distribute the Splunk Add-on for Unix and Linux (Splunk_TA_nix) component onto hosts with installed universal forwarders to collect *nix data.

Hardware and operating system requirements

The Splunk App for Unix and Linux installs directly onto a Splunk search head or indexer. It can be configured either through the app's setup user interface in Splunk Web or manually via the command line.

The Splunk Add-on for Unix and Linux installs onto either an indexer or a universal forwarder. When installed on an indexer, the add-on can be configured either through the app's setup user interface in Splunk Web or manually via the command line. When installed on a universal forwarder, the add-on must be configured manually via the command line.

Both the full app and the add-on install on Splunk instances running on many versions of Unix, including Linux, Solaris, AIX, and HP/UX.

Hardware requirements for the Splunk App for Unix and Linux depend on what you plan to do with the app. At a minimum, your hardware should meet or exceed the minimum hardware requirements for Splunk itself.

Official support

While the Splunk App for Unix and Linux can be installed on any version of *nix that Splunk supports, only the following versions have official support:

• For installation of the Splunk App for Unix and Linux, on search heads: Linux, any version that Splunk supports.
• For installation of the Splunk Add-on for Unix and Linux, on universal forwarders: All versions of *nix listed in the Unix operating systems section of the core Splunk platform's "System requirements" topic.

• For details on how to plan a Splunk deployment, refer to the following core Splunk platform documentation topics:
  • "Introduction to capacity planning for Splunk Enterprise" in the Capacity Planning Manual.

Important: Installing the Splunk Add-on for Unix and Linux onto a Windows Splunk instance will have no effect.

What web browsers does the app support?

The Splunk App for Unix and Linux is not supported on any version of Internet Explorer because it makes heavy use of scalable vector graphics (SVG), a standard for which IE has limited support.

It can, however, be used on any other Splunk-supported browser.

What other items do the app and add-on require?

The Splunk Add-on for Unix and Linux requires the sysstat package to function properly. You can download the sysstat utilities from the sysstat utilities download page or from your local package repository (depending on the version of *nix your system runs.)