Platform and hardware requirements
This topic discusses the underlying requirements for running both the Splunk App and the Splunk Add-on for Unix and Linux.
What versions of Splunk Enterprise does the app support?
The Splunk App for Unix and Linux supports the following versions of Splunk Enterprise:
- Splunk Enterprise 5.0.0 and later.
- Splunk Enterprise 6.0.0 and later.
- Splunk Enterprise 6.1.0 and later.
- Splunk Enterprise 6.2.0 and later.
- Splunk Enterprise 6.3.0 and later.
All instances of Splunk Enterprise in a Splunk App for Unix and Linux deployment must run version 5.0.0 or later.
Distributed installation of this app
This table provides a quick reference for installing this app onto a distributed deployment of Splunk Enterprise.
|Splunk instance type||Supported||Required||Comments|
|Search Heads||Yes||Yes||Install this app onto all search heads where you require knowledge management.|
|Indexers||Yes||Depends||The Splunk App for Unix and Linux does not require installation on indexers except in the case where you forward search head data to those indexers. If that is true, you must install the |
|Heavy Forwarders||Yes||No||The Splunk App for Unix and Linux does not do anything when you install it on a heavy forwarder unless that forwarder is also a search head. If you want to collect *nix data from the HF, you must also install the Splunk Add-on for Unix and Linux (|
|Universal Forwarders||No||No||Use universal forwarders to get the data you need for the app. While the app does nothing when you install it on a universal forwarder, you can install the Splunk Add-on for Unix and Linux (|
|Light Forwarders||No||No||You can use light forwarders to send data to indexers for the app, but remember that:
Distributed deployment compatibility
This table provides a quick reference for the compatibility of this add-on with Splunk distributed deployment features.
|Distributed deployment feature||Supported||Comments|
|Search Head Clusters||Yes||You can install this app on a search head cluster. Follow the procedures that this manual outlines to get the data for the app, then install the app on the cluster.|
|Indexer Clusters||Yes||Before you start the Splunk App for Unix and Linux installation, configure your indexer cluster.|
|Deployment Server||Yes||You can use a deployment server to distribute the Splunk Add-on for Unix and Linux (|
Hardware and operating system requirements
The Splunk App for Unix and Linux installs directly onto a Splunk search head or indexer. It can be configured either through the app's setup user interface in Splunk Web or manually via the command line.
The Splunk Add-on for Unix and Linux installs onto either an indexer or a universal forwarder. When installed on an indexer, the add-on can be configured either through the app's setup user interface in Splunk Web or manually via the command line. When installed on a universal forwarder, the add-on must be configured manually via the command line.
Both the full app and the add-on install on Splunk instances running on many versions of Unix, including Linux, Solaris, AIX, and HP/UX.
Hardware requirements for the Splunk App for Unix and Linux depend on what you plan to do with the app. At a minimum, your hardware should meet or exceed the minimum hardware requirements for Splunk itself.
While the Splunk App for Unix and Linux can be installed on any version of *nix that Splunk supports, only the following versions have official support:
- For installation of the Splunk App for Unix and Linux, on search heads: Linux, any version that Splunk supports.
- For installation of the Splunk Add-on for Unix and Linux, on universal forwarders: All versions of *nix listed in the Unix operating systems section of the core Splunk platform's "System requirements" topic.
- For details on how to plan a Splunk deployment, refer to the following core Splunk platform documentation topics:
- "Introduction to capacity planning for Splunk Enterprise" in the Capacity Planning Manual.
Important: Installing the Splunk Add-on for Unix and Linux onto a Windows Splunk instance will have no effect.
What web browsers does the app support?
The Splunk App for Unix and Linux is not supported on any version of Internet Explorer because it makes heavy use of scalable vector graphics (SVG), a standard for which IE has limited support.
It can, however, be used on any other Splunk-supported browser.
What other items do the app and add-on require?
The Splunk Add-on for Unix and Linux requires the
sysstat package to function properly. You can download the
sysstat utilities from the sysstat utilities download page or from your local package repository (depending on the version of *nix your system runs.)
How to get support and find more information about Splunk
What data the Splunk App and Splunk Add-on for Unix and Linux collect
This documentation applies to the following versions of Splunk® App for Unix and Linux: 5.2.2