Splunk 5.0

Installation Manual

Generated: 11/01/2012 4:04 pm

Copyright © 2012 Splunk, Inc. All Rights Reserved

Table of ContentsWelcome to the Splunk Installation Manual......................................................1

What's in this manual................................................................................1

Plan your Splunk installation..............................................................................2 Installation overview..................................................................................2System requirements.................................................................................3 Components of a Splunk deployment.......................................................8 Estimate your storage requirements.......................................................10 Splunk architecture and processes.........................................................12 Step-by-step installation instructions.......................................................14

Estimate hardware requirements.....................................................................16Hardware capacity planning for your Splunk deployment........................16 How incoming data affects Splunk performance.....................................18 How indexed data impacts Splunk performance.....................................19 How the number of concurrent users impacts Splunk performance.......19 How saved searches affect Splunk performance....................................20 How search types impact Splunk performance.......................................20 How Splunk apps affect Splunk performance.........................................22 How Splunk calculates disk storage........................................................22 Reference hardware................................................................................23 Performance questionnaire.....................................................................26 Summary of performance recommendations..........................................28

Install Splunk on Windows...............................................................................30Choose the user Splunk should run as....................................................30 Install on Windows..................................................................................35 Install on Windows via the command line...............................................39Correct the user selected during Windows installation............................46

Install Splunk on Unix, Linux or Mac OS X......................................................48 Install on Linux........................................................................................48 Install on Solaris......................................................................................51 Install on Mac OS....................................................................................54 Install on FreeBSD..................................................................................58 Install on AIX...........................................................................................61 Install on HP-UX......................................................................................63 Run Splunk as a different or non-root user.............................................65

i

Table of ContentsStart using Splunk.............................................................................................68

Start Splunk for the first time...................................................................68What happens next?................................................................................70 Learn about Splunk's accessibility..........................................................71

Install a Splunk license.....................................................................................73 About Splunk licenses.............................................................................73 Install a license........................................................................................73

Upgrade Splunk from an earlier version..........................................................76 How to upgrade Splunk...........................................................................76 About upgrading to 5.0 READ THIS FIRST............................................78 Upgrade to 5.0 on UNIX..........................................................................81 Upgrade to 5.0 on Windows....................................................................83 Upgrade PDF printing for Splunk Web....................................................85

Uninstall Splunk.................................................................................................92 Uninstall Splunk......................................................................................92

Reference............................................................................................................96 File and directory structure......................................................................96 PGP Public Key.......................................................................................98

ii

Welcome to the Splunk Installation Manual

What's in this manual

Use this guide to find system requirements, licensing information, andprocedures for installing or migrating Splunk.

Note: If you want to install the Splunk universal forwarder, see the DistributedDeployment manual: "Universal forwarder deployment overview". Unlike Splunkheavy and light forwarders, which are full Splunk instances with some featureschanged or disabled, the universal forwarder is an entirely separate executable,with its own set of installation procedures. For an introduction to forwarders, see"About forwarding and receiving".

Find what you need

You can use the table of contents to the left of this panel, or simply search forwhat you want in the search box in the upper right.

If you're interested in more specific scenarios and best practices, you can visitthe Splunk Community Wiki to see how other users Splunk IT.

Make a PDF

If you'd like a PDF of any version of this manual, click the red Download as PDFlink below the table of contents on the left side of this page. A PDF version of themanual is generated on the fly for you, and you can save it or print it out to readlater.

1

Plan your Splunk installation

Installation overview

This topic discusses the basic steps required to install Splunk on a computer. Westrongly suggest that you read this topic and the contents of this chapter firstbefore performing an installation.

Installation basics

The following list provides concepts and details on what you need to installSplunk:

1. Review the system requirements for installation. Specific additionalrequirements might apply based on the operating system you install Splunk on.

2. Read "Components of a Splunk deployment" to learn about Splunk'secosystem, and "Splunk architecture and processes" to learn what gets installedon your computer.

3. Download the correct installation package for your system from the Splunkdownload page.

4. Perform the installation using the step-by-step installation instructions for youroperating system.

5. After you've installed Splunk, you can calculate how much space you will needto index your data. Read "Estimate your storage requirements" for additionalinformation.

6. If you plan to run Splunk in a production environment, review "Hardwarecapacity planning for your Splunk deployment" in this manual for insight into theamount of hardware a Splunk deployment requires.

Upgrading?

If you're upgrading from an earlier version of Splunk, read "How to upgradeSplunk" in this manual for information and specific instructions.

2

System requirements

Before you download and install the Splunk software, read this topic to learnwhich computing environments Splunk supports. If you have ideas or requestsfor new features to add to future releases, get in touch with Splunk Support. Youcan also follow our product road map.

Refer to the download page for the latest version to download. Check the releasenotes for details on known and resolved issues.

For a discussion of hardware planning for deployment, review "Hardwarecapacity planning for your Splunk deployment" in this manual.

Supported OSes

Splunk supports installation on the following platforms:

Unix operating systems

Operatingsystem Architecture Enterprise / Trial Universal Forwarder

Solaris 8*, 9, 10,and 11*

x86 (64-bit) x* x*

SPARC x x

x86 (32-bit) x* x*

Linux, 2.6+ x86 (64-bit) x x

x86 (32-bit) x x

Linux, 2.4+ withNative POSIXThread Library

x86 (64-bit)

x86 (32-bit) x x

FreeBSD 7** and 8 x86 (64-bit) x x

x86 (32-bit) x x

Mac OS X 10.5,10.6, and 10.7 all (Universal) x x

AIX 5.3, 6.2, and7.1 PowerPC x x

HP/UX? 11i v2 and11i v3

Itanium x x

PA-RISC x x

* Solaris 8 does not support 64-bit Splunk installs. Also, Solaris 11 does notsupport 32-bit Splunk installs.** Be sure to read important notes on FreeBSD 7 below.

3

? You must use gnu tar to unpack the HP/UX installation archive.

Windows operating systems

Be sure to read important notes about all Windows operating systems below.

Operatingsystem Architecture Enterprise / Trial Universal Forwarder

Windows Server2003 and Server2003 R2

x86 (64-bit) x x

x86 (32-bit) x*** x***

Windows Server2008 and Server2008 R2

x86 (64-bit) x x

x86 (32-bit) x*** x***

Windows XP,Windows Vista, andWindows 7

x86 (64-bit) x x

x86 (32-bit) x*** x***

*** This version of Splunk is supported but is not recommended on this platform.

Operating system notes and additional information

Windows

Certain parts of Splunk on Windows require elevated user permissions tofunction properly. For additional information about what is required, read thefollowing topics:

"Splunk architecture and processes" in this manual.• "Choose the user Splunk should run as" in this manual.• "Considerations for deciding how to monitor remote Windows data" in theGetting Data In Manual.

•

FreeBSD 7.x

To run Splunk 5.x on 32-bit FreeBSD 7.x, install the compat6x libraries. SplunkSupport will supply "best effort" support for users running on FreeBSD 7.x. Formore information, refer to "Install Splunk on FreeBSD 7" in the Community Wiki.

Deprecated operating systems and features

As we continue to version the Splunk product, we gradually deprecate support ofolder operating systems. Be sure to read "Deprecated features" in the ReleaseNotes for information on which platforms and features have been deprecated or

4

removed entirely.

Creating and editing configuration files on non-UTF-8 OSes

Splunk expects configuration files to be in ASCII/UTF-8 format. If you edit orcreate a configuration file on an OS that is non-UTF-8, you must ensure that theeditor you are using is configured to save in ASCII/UTF-8.

IPv6 platform support

All Splunk-supported OS platforms are supported for use with IPv6 configurationsexcept for the following:

AIX• HP/UX on PA-RISC architecture• Solaris 9•

Refer to "Configure Splunk for IPv6" in the Admin Manual for details on SplunkIPv6 support.

==Supported browsers==

Firefox 3.6, 10.x, and latest• Internet Explorer 6, 7, 8, and 9• Safari (latest)• Chrome (latest)•

You should also make sure you have the latest version of Flash installed torender any charts that use options not supported by the JSChart module. Formore information about this subject, see "About JSChart" in the Splunk DataVisualizations Manual.

Recommended hardware

Splunk is a high-performance application. If you are performing a comprehensiveevaluation of Splunk for production deployment, we recommend that you usehardware typical of your production environment. This hardware should meet orexceed the recommended hardware capacity specifications below.

For a discussion of hardware planning for production deployment, see"Hardware capacity planning for your Splunk deployment" in this manual.

5

Splunk and virtual machines

If you run Splunk in a virtual machine (VM) on any platform, performance willdegrade. This is because virtualization works by abstracting the hardware on asystem into resource pools from which VMs defined on the system draw asneeded. Splunk needs sustained access to a number of resources, particularlydisk I/O, for indexing operations. Running Splunk in a VM or alongside other VMscan cause reduced indexing performance.

Recommended and minimum hardware capacity

Platform Recommended hardwarecapacity/configuration

Minimumsupportedhardwarecapacity

Non-Windowsplatforms

2x quad-core Intel Xeon, 3 GHz, 8 GB RAM,Redundant Array of Independent Disks (RAID) 0 or1+0, with a 64 bit OS installed.

1x1.4 GHz CPU, 1 GBRAM

Windowsplatforms

2x quad-core Intel Xeon, 3 GHz, 8 GB RAM, RAID 0or 1+0, with a 64 bit OS installed.

Pentium 4 orequivalent at 2 GHz, 2GB RAM

Note: RAID 0 configurations do not provide fault-tolerance. Be certain that aRAID 0 configuration meets your data reliability needs before deploying a Splunkindexer on a system configured with RAID 0.

All configurations other than universal and light forwarder instancesrequire at least the recommended hardware configuration.

•

The minimum supported hardware guidelines are designed for personaluse of Splunk. The requirements for Splunk in a production environmentare significantly higher.

•

Important: For all installations, including forwarders, you must have a minimumof 2 GB of hard disk space available in addition to the space required for anyindexes. Refer to "Estimate your storage requirements" in this manual foradditional information.

Hardware requirements for universal and light forwarders

Recommended Dual-core 1.5 GHz+ processor, 1 GB+ RAM

Minimum 1.0 Ghz processor, 512 MB RAM

6

Supported file systems

Platform File systemsLinux ext2/3/4, reiser3, XFS, NFS 3/4

Solaris UFS, ZFS, VXFS, NFS 3/4

FreeBSD FFS, UFS, NFS 3/4, ZFS

Mac OS X HFS, NFS 3/4

AIX JFS, JFS2, NFS 3/4

HP-UX VXFS, NFS 3/4

Windows NTFS, FAT32

Note: If you run Splunk on a filesystem that is not listed above, Splunk might runa startup utility named locktest to test the viability of a filesystem for runningSplunk. Locktest is a program that tests the start up process. If locktest runsand fails, then the filesystem is not suitable for running Splunk.

Considerations regarding File Descriptors (FDs)

Splunk allocates file descriptors on *nix systems for actively monitored files,forwarder connections, deployment clients, users running searches, and so on.

Usually, the default file descriptor limit (ulimit) on a *nix-based OS is 1024. YourSplunk administrator should determine the correct level, but it should be at least2048. Even if Splunk allocates just a single file descriptor for each of the activitiesabove, it?s easy to see how a few hundred files being monitored, a few hundredforwarders sending data, a handful of very active users on top of reading/writingto/from the datastore can easily exhaust the default setting.

The more tasks your Splunk instance is doing, the more FDs it will need, so youshould increase the ulimit value if you start to see your instance run intoproblems with low FD limits.

For more information, read about ulimit in the Troubleshooting Manual.

This consideration is not applicable to Windows-based systems.

Considerations regarding Network File System (NFS)

NFS is often a poor choice for Splunk indexing activity, owing to performance,resilience, and semantics.

7

In environments with very high-bandwidth, very low-latency, reliable links, it canbe an appropriate choice. Typically, this is implemented via a SAN (Storage AreaNetwork) accessed via the NFS protocol.

Splunk does not support "soft" NFS mounts (mounts which cause a programattempting a file operation on the mount to report an error in case of a failure).Only "hard" NFS mounts are reliable with Splunk.

When mounting NFS volumes, do not disable attribute caching. If you have otherapplications which require disabling or reducing attribute caching, then you mustprovide Splunk a separate mount with attribute caching enabled.

If you use NFS in a distributed Splunk environment, do not use NFS mounts overa wide area network (WAN). Doing so will cause performance issues. Read"Distributed Splunk overview" in the Distributed Deployment Manual foradditional information.

Note: On FreeBSD, Splunk does not support nullfs mounts.

Considerations regarding solid state drives

Solid state drives (SSDs) gain most of their performance through readoperations. Splunk relies on fast disk write performance in order to index datawith low latency. SSDs do not provide a significant write-speed advantage inSplunk over fast conventional hard drives.

SSDs deliver significant performance gains over conventional hard drives forSplunk in "rare" searches - searches that request small sets of results over largeswaths of data - when used in combination with bloom filters. They also deliverperformance gains with concurrent searches overall.

Supported server hardware architectures

32 and 64-bit architectures are supported for some platforms. See the downloadpage page for details.

Components of a Splunk deployment

Splunk is simple to deploy by design. By using a single software component andeasy to understand configurations, Splunk can coexist with existing infrastructureor be deployed as a universal platform for accessing IT data.

8

The simplest deployment is the one you get by default when you install Splunk:indexing and searching on the same server. Data comes in from the sourcesyou've configured, and you log into Splunk Web or the CLI on this same server tosearch, monitor, alert, and report on your IT data.

Depending on your needs, you can also deploy components of Splunk ondifferent servers to address your load and availability requirements. This sectionintroduces the types of components. For a more thorough introduction, see theDistributed Deployment manual, particularly the topic, "Scale your deployment:Splunk components".

Indexer

Splunk indexers, or index servers, provide indexing capability for local andremote data and host the primary Splunk datastore, as well as Splunk Web.Refer to "How indexing works" in the Managing Indexers and Clusters manual formore information.

Search peer

A search peer is an indexer that services requests from search heads in adistributed search deployment. Search peers are also sometimes referred to asindexer nodes.

Search head

A search head is a Splunk instance configured to distribute searches toindexers, or search peers. Search heads can be either dedicated or not,depending on whether they also perform indexing. Dedicated search heads don'thave any indexes of their own (other than the usual internal indexes). Instead,they consolidate results that originate from remote search peers.

See "What is distributed search" in the Distributed Deployment Manual toconfigure a search head to search across a pool of indexers.

Forwarder

Forwarders are Splunk instances that forward data to remote indexers forindexing and storage. In most cases, they do not index data themselves. Refer tothe "About forwarding and receiving" topic in the Distributed Deployment manual.

9

Deployment server

Both indexers and forwarders can also act as deployment servers. Adeployment server distributes configuration information to running instances ofSplunk via a push mechanism which is enabled through configuration. Refer to"About deployment server" in the Distributed Deployment Manual for additionalinformation about the deployment server.

Functions at a glance

Functions Indexer Search head Forwarder Deployment serverIndexing x

Web x

Direct search x

Forward to indexer x

Deploy configurations x x x

Estimate your storage requirements

This topic describes how to estimate the size of your Splunk index, so that youcan plan your storage capacity requirements.

When Splunk indexes your data, it creates two main types of files: the "rawdata"file that contains the original data in compressed form and the index files thatpoint to this data. (It also creates a few metadata files, which don't consumemuch space.) With a little experimentation, you can estimate how much indexdisk space you will need for a given amount of incoming data.

Typically, the compressed rawdata file is approximately 10% the size of theincoming, pre-indexed raw data. The associated index files range in size fromapproximately 10% to 110% of the rawdata file. This value is affected strongly bythe number of unique terms in the data. Depending on the data's characteristics,you might want to tune your segmentation settings, as described in "Aboutsegmentation" in the Getting Data In Manual.

The best way to get an idea of your space needs is to experiment by indexing arepresentative sample of your data, and then checking the sizes of the resultingdirectories in defaultdb.

10

On *nix systems, follow these steps

Once you've indexed your data sample:

1. Go to $SPLUNK_HOME/var/lib/splunk/defaultdb/db.

2. Run du -ch hot_v* and look at the last total line to see the size of the index.

On Windows systems, follow these steps

1. Download the du utility from Microsoft TechNet.

2. Extract du.exe from the downloaded ZIP file and place it into your%SYSTEMROOT% folder.

Note: You can also place it anywhere in your %PATH%.

3. Open a command prompt.

4. Once there, go to %SPLUNK_HOME%\var\lib\splunk\defaultdb\db.

5. Run del %TEMP%\du.txt & for /d %i in (hot_v*) do du -q -u %i\rawdata| findstr /b "Size:" >> %TEMP%\du.txt.

6. Open the %TEMP%\du.txt file. You will see Size: n, which is the size of eachrawdata directory found.

7. Add these numbers together to find out how large the compressed persistedraw data is.

8. Next, run for /d %i in (hot_v*) do dir /s %i, the summary of which is thesize of the index.

9. Add this number to the total persistent raw data number.

This is the total size of the index and associated data for the sample you haveindexed. You can now use this to extrapolate the size requirements of yourSplunk index and rawdata directories over time.

Answers

Have questions? Visit Splunk Answers to see what questions and answers other

11

Splunk users had about data sizing.

Splunk architecture and processes

This topic discusses Splunk's internal architecture and processes at a high level.If you're looking for information about third-party components used in Splunk,refer to the credits section in the Release notes.

Processes

A Splunk server runs two processes (installed as services on Windows systems)on your host, splunkd and splunkweb:

splunkd is a distributed C/C++ server that accesses, processes andindexes streaming IT data. It also handles search requests. splunkdprocesses and indexes your data by streaming it through a series ofpipelines, each made up of a series of processors.

Pipelines are single threads inside the splunkd process, eachconfigured with a single snippet of XML.

♦

Processors are individual, reusable C or C++ functions that act onthe stream of IT data passing through a pipeline. Pipelines canpass data to one another via queues. splunkd supports acommand line interface for searching and viewing results.

♦

•

splunkweb is a Python-based application server based on CherryPy thatprovides the Splunk Web user interface. It allows users to search andnavigate IT data stored by Splunk servers and to manage your Splunkdeployment through a Web interface.

•

splunkweb and splunkd can both communicate with your Web browser viaRepresentational state transfer (REST):

splunkd also runs a Web server on port 8089 with SSL/HTTPS turned onby default.

•

splunkweb runs a Web server on port 8000 without SSL/HTTPS by default.•

On Windows systems, splunkweb.exe is a third-party, open-source executablethat Splunk renames from pythonservice.exe. Since it is a renamed file, it doesnot contain the same file version information as other Splunk for Windowsbinaries.

Read information on other Windows third-party binaries distributed with Splunk.

12

Splunk and Windows in Safe Mode

Neither the splunkd nor the splunkweb services starts if Windows is in SafeMode. Additionally, if you attempt to start Splunk from the Start Menu while inSafe Mode, Splunk does not alert you to the fact that its services are not running.

Additional processes for Splunk on Windows

On Windows instances of Splunk, in addition to the two services describedabove, there are additional processes that Splunk uses when you create specificdata inputs on a Splunk instance. These scripted inputs run when configured bycertain types of Windows-specific data input.

splunk.exe

splunk.exe is the control application for the Windows version of Splunk. Itprovides the command line interface (CLI) for the program, and allows you tostart, stop, and configure Splunk, similar to the *nix splunk program.

Important: splunk.exe requires an elevated context to run because of how itcontrols the splunkd and splunkweb processes. Splunk might not functioncorrectly if this executable is not given the appropriate permissions on yourWindows system. This is not an issue if you install Splunk as the Local Systemuser.

splunk-admon

splunk-admon.exe is spawned by splunkd whenever you configure an ActiveDirectory (AD) monitoring input. splunk-admon's purpose is to attach to thenearest available AD domain controller and gather change events generated byAD. Splunk then stores these events in the desired index.

splunk-perfmon

splunk-perfmon.exe (new for version 4.2) runs when you configure Splunk tomonitor performance data on the local machine. This service attaches to thePerformance Data Helper libraries, which query the performance libraries on thesystem and extract performance metrics both instantaneously and over time.

splunk-regmon

splunk-regmon.exe runs when you configure a Registry monitoring input inSplunk. This scripted input initially writes a baseline for the Registry as it

13

currently exists (if desired), then monitors changes to the Registry over time.Those changes come back into Splunk as searchable events.

splunk-winevtlog

You can use this utility to test defined event log collections, and it outputs eventsas they are collected for investigation. Splunk has a Windows event log inputprocessor built into the engine.

splunk-wmi

When you configure a performance monitoring, event log or other input against aremote computer, this program starts up. Depending on how you configure theinput, either it attempts to attach to and read Windows event logs as they comeover the wire, or it executes a Windows Query Language (WQL) query againstthe Windows Management Instrumentation (WMI) provider on the specifiedremote machine(s). Splunk then stores the events.

Architecture diagram

Step-by-step installation instructions

Now that you've learned what Splunk is and what is needed to install it, you canget detailed installation procedures for your operating system:

Windows• Windows (from the command line)• Linux• Solaris• Mac OS X• FreeBSD• AIX•

14

HP-UX•

15

Estimate hardware requirements

Hardware capacity planning for your Splunkdeployment

Splunk is a flexible product that meets almost any scale and redundancyrequirement in the course of its operation. Taking advantage of that flexibilityrequires careful planning. This chapter discusses high level hardware guidancefor Splunk deployments and describes how Splunk uses hardware resources invarious situations.

Before deciding on your hardware outlay for Splunk:

1. Be sure to review "Components of a Splunk Deployment" in this manual for adescription of all of the elements of a Splunk installation.

2. Next, learn about the type of hardware that comprises a "single indexer" byreading "Reference hardware."

3. Finally, read the remaining topics in this chapter to learn how Splunkoperations impact performance and how to maximize that performance.

Dimensions of a Splunk deployment

In some cases, a single indexer can handle the load of both searching andindexing.

There are scenarios where you must consider adding infrastructure to yourSplunk deployment for maximum efficiency and performance. Below is a list ofthings that significantly impact Splunk's performance:

1. The amount of incoming data. The more data you send to Splunk, the moretime Splunk needs to index it into results that you can search, report andgenerate alerts on.

2. The amount of indexed data. As the amount of data stored in Splunk's indexgoes up, the server that indexes that data requires additional bandwidth both tostore the data and provide results for searches.

16

3. The number of concurrent users. If more than one person at a time uses aninstance of Splunk, that instance requires more resources for those users to dosearches and create reports and dashboards.

4. The number of saved searches. If you plan on running a lot of savedsearches, Splunk needs capacity to perform those searches promptly andefficiently. The more saved searches you run in a given period of time, the moreresources are required.

5. The types of search you employ. Almost as important as the number ofsaved searches is the types of search that you run against a Splunk system.There are several different types of search, each of which affects how theindexer responds to search requests.

6. Whether or not you run Splunk apps. Splunk apps and solutions can haveunique performance, deployment, and configuration considerations. If you planon running apps, make sure you consider the resource requirements of theapp(s) you are using. Refer to the installation and deployment section of yourapp or solution's documentation for additional information. Additionally, read"Hardware capacity planning for a distributed Splunk deployment" to learn how toproperly size your environment for an app's increased resource requirements.

How do these dimensions impact overall performance?

Follow the links above to determine how each of the dimensions impactsperformance on a reference indexer.

While these factors impact the basic sizing requirements of your Splunkdeployment on the whole, it's important to understand that addressing each ofthem individually does not guarantee peak efficiency for your Splunk deployment.You must discover how these factors correlate with one another in your specificapplication in order to realize maximum performance.

For example, if your Splunk deployment calls for a low amount of indexing buthas a high number of concurrent users, it has significantly different resourceneeds than a setup with a low number of concurrent users and a high amount ofdaily indexing volume. Additionally, as both user count and amount of indexeddata rise, you must distribute the environment across multiple servers to maintaina similar performance level. Search types complicate matters further, as someare bound by available CPU resources, and others are bound by the speed of thedisk subsystem.

17

When should I scale my Splunk deployment?

To best answer this question you must understand how the above Splunkdeployment dimensions apply to your specific use case. Ask yourself thesequestions, then refer to the performance questionnaire later in this chapter tohelp ascertain when you should add more hardware resources:

How much data do you expect to index daily?• How much data do you need to retain?• How many users do you expect to search through the data at any onetime?

•

Do you plan to use certain specific searches more than once?• Do you want or need to use a Splunk app to present or manipulate yourdata?

•

The key to a well-performing installation is to develop a plan early in thedeployment cycle to account for both your initial outlay of hardware resources, aswell as the addition of resources when the deployment scales up.

You can read about capacity planning for a distributed deployment is available at"Hardware capacity planning for a distributed Splunk deployment" in theDistributed Deployment Manual.

How incoming data affects Splunk performance

This topic discusses how incoming data impacts Splunk indexing performance.

A reference Splunk indexer can index a significant amount of data in a shortperiod of time - up to 5.8 MB of data per second - or 500 GB per day. This is ifthe server is doing nothing else but consuming data.

Performance changes depending on the size and amount of incoming data.Larger events slow down indexing performance. The larger an event is, the morememory is needed to process and index the event.

If you need additional indexing capacity, you must add indexers into thedeployment to account for the increased demand.

18

How indexed data impacts Splunk performance

This topic discusses how data that has already been consumed by Splunk affectsSplunk performance.

Once Splunk consumes data and places it into indexes, those indexes grow,taking up disk space. As the indexes grow and available disk space decreases,Splunk takes more time to index incoming data because the indexer's disksubsystem takes more time to find space to store the data.

This impacts search as well. On a single indexer, disk throughput is split betweenindexing (which is ongoing) and search requests (which are interrupts based onrequests scheduled by users.) As indexes grow, search slows down because notonly does the disk subsystem need to account for search requests, it also needsto handle increasingly longer requests to store incoming data. Depending on thetype of search, those kinds of requests can be very I/O-intensive.

How the number of concurrent users impactsSplunk performance

This topic discusses how the number of concurrent users impacts Splunk'sperformance on a single indexer.

A reference Splunk indexer needs to dedicate one of its available CPU cores forevery user that logs into the system. This CPU core only handles the actualsession itself. When a user starts searching, each search request takes up anadditional CPU core, for as long as the search is active.

These figures assume that CPUs are idle when they receive a login or searchrequest. This does not account for other system requests, or CPU cores used bySplunk to index data. If they're processing any other system requests, then theload splits across other available CPUs.

As CPU cores get used up, all activities on an indexer slow down as thecomputer splits processing time between indexing, search, and handling on-lineusers. At that point, only additional indexers can increase capacity for all threefunctions of Splunk operation.

19

How saved searches affect Splunk performance

This topic discusses how the number of saved searches - searches that yousave to use again at a later time - affect Splunk performance.

On a reference Splunk indexer, a saved search consumes about 1 CPU core anda specified amount of memory while it executes. It also increases the amount ofdisk I/O temporarily as the disk subsystem looks through the indexes to fetch thedesired data.

Each additional saved search that executes at the same time consumes anadditional CPU core. This consumption is separate from CPU usage from theoperating system and Splunk indexing and storage processes.

If more saved searches execute than can be accepted for processing, they willqueue. Splunk also warns you when the system reaches the maximum numberof saved searches. When searches queue, search results return more slowly.

Adding indexers and search heads provides additional CPU cores to run moreconcurrent searches. Adding RAM to your existing machines helps withconcurrent searches but does not give you additional search capacity.

How search types impact Splunk performance

This topic discusses how the different types of search impact Splunk's overallperformance on a single reference indexer.

There are four basic types of search that you can invoke against data stored in aSplunk index. Each of these search types impacts the Splunk indexer in adifferent way. The search types are:

Dense. A dense search is a search that returns a large percentage (10% ormore) of matching results for a given set of data in a given period of time. Areference server should be able to fetch up to 50,000 matching events persecond for a dense search. Dense searches usually tax a server's CPU first,because of the overhead required to decompress the raw data stored in a Splunkindex.

Sparse. Sparse searches return smaller numbers of results for a given set ofdata in a given period of time (anywhere from .01 to 1%) than dense searchesdo. A reference indexer should be able to fetch up to 5,000 matching events per

20

second when executing a sparse search.

Super-sparse. A super-sparse search is a "needle in the haystack" search thatretrieves only a very small number of results across the same set of data withinthe same time period as the other searches. A super-sparse search is very I/Ointensive because the indexer must look through all of the buckets of an index tofind the desired results. This can take up to two seconds per searched bucket. Ifyou have a large amount of data stored on your indexer, there are a lot ofbuckets, and a super-sparse search can take a very long time to complete.

Rare. Rare searches are like super-sparse searches in that they match just ahandful of results across a number of index buckets. The major difference withrare searches is that bloom filters - data structures that test whether or not anelement is a member of a set - significantly reduce the number of buckets thatneed to be searched by eliminating those buckets which do not contain eventsthat match the search request. This allows a rare search to complete anywherefrom 20 to 100 times faster than a super-sparse search, for the same amount ofdata searched.

Summary

The following table summarizes the different search types. Note that for denseand sparse searches, Splunk measures performance based on number ofmatching events, while with super-sparse and rare searches, performance ismeasured based on total indexed volume.

Searchtype

Description Ref. indexerthroughput

Performanceimpact

DenseDense searches return a largepercentage of results for a given set ofdata in a given period of time.

Up to 50,000matching eventsper second

GenerallyCPU-bound

Sparse

Sparse searches return a smaller amountof results for a given set of data in agiven period of time than dense searchesdo.

Up to 5,000matching eventsper second

GenerallyCPU-bound

Super-sparse

Super-sparse searches return a verysmall number of results from each indexbucket which match the search.Depending on how large the set ofdata is, these types of search cantake a long period of time.

Up to 2 secondsper index bucket

Primarily I/Obound

Rare Rare searches are similar tosuper-sparse searches, but are assisted

From 10 to 50index buckets per

Primarily I/Obound

21

by bloom filters which helpeliminate index buckets that donot match the search request.Rare searches return resultsanywhere from 20 to 100 timesfaster than a super-sparse searchdoes.

second

How Splunk apps affect Splunk performance

This topic discusses how Splunk apps impact overall Splunk performance on asingle reference indexer.

While many apps can run on a single indexer - Splunk actually runs severalincluded with the product - the more things an app does, the more likely you mustdistribute it across multiple machines.

Many apps require a distributed Splunk deployment by design. Whether it's acase of universal forwarders fetching data and sending it to a single centralinstance, or many indexers and search heads connected together and serving upreports, dashboards, or alerts, Splunk apps often need more than one server torealize both maximum performance and potential in the enterprise.

How Splunk calculates disk storage

This topic discusses how Splunk calculates disk storage.

At a high level, Splunk calculates total disk storage as follows:

( Daily average indexing rate ) x ( retention policy ) x 1/2

If you want to base your calculation on the specific type(s) of data that Splunk willindex, you can use the method described in "Estimate your storagerequirements" in this manual.

Splunk stores raw data at up to approximately half its original size due tocompression. On a volume that contains 500 GB of usable disk space, thismeans you can store nearly 6 months' worth of data at an indexing rate of 5GB/day, or 10 days' worth at a rate of 100 GB/day.

22

If you need additional storage, you can opt for either more local disks (requiredfor frequent searching) or attached or network storage (acceptable for occasionalsearching). Low-latency connections over NFS or SMB/CIFS (Server MessageBlock/Common Internet File System) are acceptable for searches over long timeperiods where instant search returns can be compromised to lower cost per GB.

Important: Shares mounted over a Wide Area Network (WAN) connection or onstandby storage such as tape are never suitable storage choices for Splunkoperations.

Reference hardware

When sizing your Splunk environment's hardware needs, a reference machinehelps you understand when it is time to scale and distribute the deployment.Following is an example of such a machine. Refer to this configuration as thestandard for the remainder of this chapter.

The reference machine described below produces the following index and searchperformance metrics for a given sample of data:

Indexing performance

Up to 5.8 megabytes per second (500 GB per day) of raw indexingperformance, provided no other Splunk activity is occurring.

•

Search performance

Up to 50,000 events per second for dense searches• Up to 5,000 events per second for sparse searches• Up to 2 seconds per index bucket for super-sparse searches• From 10 to 50 buckets per second for rare searches with bloom filters•

To find out more about the types of searches and how they affect Splunkperformance, read "How search types affect Splunk performance" in this manual.

Bare-metal hardware

Intel x86 64-bit chip architecture• 2 CPUs, 4 cores per CPU (8 cores total), at least 2.5 Ghz per core• 8 GB RAM• Standard 1 Gb Ethernet NIC, optional 2nd NIC for a management network•

23

Standard 64-bit Linux or Windows distribution•

Disk subsystem

The reference computer's disk subsystem should be capable of handling a highnumber of averaged Input/Output Operations Per Second (IOPS).

IOPS are a measurement of how much data throughput a hard disk can produce.Since a hard drive reads and writes at different speeds, there are IOPS numbersfor disk reads and writes. The average IOPS is the blend between those twofigures.

The more average IOPS a drive can produce, the more data it can index andsearch in a shorter period of time. While many variable items factor into theamount of IOPS that a hard drive can produce, the three most importantelements are:

its rotational speed (in revolutions per minute)• its average latency (the amount of time it takes to spin its platters half arotation)

•

its average seek time (the amount of time it takes to retrieve a requestedblock of data.)

•

To get the most IOPS out of a hard drive, always choose those drives that havehigh rotational speeds and low average latency and seek times. Every drivemanufacturer provides this information (and some provide much more).

For additional information on IOPS and how to calculate them, review thefollowing articles:

"Getting the hang of IOPS(http://www.symantec.com/connect/articles/getting-hang-iops-v13) onSymantec's Connect Community.

•

"Analyzing I/O performance in Linux(http://www.cmdln.org/2010/04/22/analyzing-io-performance-in-linux) onCMDLN.ORG (A sysadmin blog).

•

For this application, we use eight 146-gigabyte, 15,000 RPM serial-attachedSCSI (SAS) HDs in a Redundant Array of Independent Disks (RAID) 1+0 faulttolerance scheme as the disk subsystem. Each hard drive is capable of about200 average IOPS. The combined array produces a little over 800 IOPS.

24

Important: Splunk is often constrained by disk I/O first, so always consider diskinfrastructure first when specifying your hardware.

Virtual hardware

Splunk performs fastest when deployed directly on to bare-metal hardware, asdescribed above. However, Splunk can and does deliver on virtual equipment.What's more, we fully support deploying Splunk on virtual hardware.

Using the bare metal hardware as a baseline, Splunk generally indexes dataabout 30% slower on a virtual machine (VM) than it does on a standard referencemachine. Search performance is on par with the real-world hardware.

This is a best-case scenario that does not account for resource contention withother active VMs on the same physical server. It also does not take into accountcertain vendor-specific I/O enhancement techniques (such as Direct I/O or RawDevice Mapping).

Splunk in the cloud

There are two different ways to run Splunk in the cloud: Splunk Enterprise (theversion you download from Splunk's website) in your own cloud environment, orSplunk's new cloud-based solution, Splunk Storm.

Splunk Enterprise in the cloud

While you can run Splunk in the cloud, there are various concerns that you mustbe aware of when doing so. In addition to the security concerns of runningSplunk in a public cloud, you must also note that performance degradessignificantly compared to bare-metal hardware. Using that benchmark as abaseline again, Splunk indexing performance on a cloud-based computer isroughly half that of a real one. Searching suffers, too - results return anywherefrom 15 to 20 percent slower than on a physical machine.

Splunk Storm

Splunk Storm is for users who prefer to consume services over installingsoftware. Splunk Storm is the power of Splunk delivered as a pay-as-you-goservice. Splunk Storm is for users who prefer not to manage their own servers orsoftware installations.

The tradeoff is that Splunk Storm isn't as full-featured as Splunk Enterprise anddoesn't provide as much flexibility when it comes to user management. Advanced

25

Splunk features such as alerting, summary indexing, custom sourcetypes anddata preview, field extractions based on delimiters, lookups, apps, LDAPintegration, and a fully functional REST API are not yet available in SplunkStorm.

Performance questionnaire

Overview

This topic helps you make the choice on whether or not to distribute your Splunkdeployment.

This questionnaire is for a single-server Splunk deployment based on thereference architecture described in "Reference hardware."

Determine when to scale your Splunk deployment

Before you consider whether or not to scale, estimate how much data you needto index, and whether or not you need more than one concurrent Splunk user tosearch that data.

Depending on how much data you index and how many concurrent users yourequire, you might need to scale your environment to multiple machines. Even ifyour indexing amount and user count falls within the capabilities of a singleserver, you might have to distribute your deployment based on the types ofsearches you employ, and whether or not you use summary indexes.

If you want to run a Splunk app or solution in your Splunk environment, or youcreate elements that generate a large number of saved searches, you mighthave to distribute Splunk components across a number of machines.

Question 1: Do you want to create or run a Splunk app, alert or solutionthat executes a large number of saved searches (more than 8concurrently)?

A saved search is a search that a user saves to make available for later use. Thenumber of saved searches - especially those run concurrently - directly impacts aSplunk server's performance. If you answered "NO" to this question, thenproceed to Question 2. You don't need to consider scaling your Splunkdeployment to multiple machines just yet.

26

However, if you answered "YES" then you should scale your Splunk deploymentto multiple machines. Review detailed information on hardware capacity planningfor distributed Splunk deployments in "Hardware capacity planning for adistributed Splunk Deployment" in the Distributed Deployment Manual.

Question 2: Do you need to index more than 2 GB of data per day?

Question 3: Do you need more than 2 users signed in at one time?

If the answer to both questions is 'NO' then your Splunk instance can safelyshare one of the reference servers with other services, with the caveat thatSplunk must have sufficient disk I/O bandwidth on the shared machine.

If you answered "yes" to either question then proceed to Question 4.

Note: If you are deploying Splunk on Windows, you must not share full Splunkservices on servers that run Microsoft Exchange, Active Directory domainservices, or machine virtualization software. This is because those services areoften very disk I/O intensive, and can dramatically reduce indexing and searchperformance. Additionally, you must ensure that any anti-virus software installedon the server does not scan the Splunk installation directory.

Question 4: Do you need to index more than 100 GB per day?

Question 5: Do you need more than 4 concurrent users?

If the answer to both questions is 'NO' then a single dedicated Splunk server ofour reference architecture should be able to handle your workload.

Question 6: Do you need more than 500GB of total storage?

Read "How Splunk calculates disk storage" to learn how Splunk calculates diskstorage.

If the answer to this question is "NO" then a single dedicated reference Splunkserver should be able to handle your workload, but you might need to add faststorage to the system to account for the increased space usage.

If the answer to this question is "YES" then you should consider scaling yourdeployment to additional indexers to cope with the increased demand of indexingand searching.

27

Question 7: Do you need to search large quantities of data for a small set(less than 1 per cent) of results?

Searches that cover large quantities of data and return small sets of results areknown as super-sparse searches. These searches require lots of disk I/Obecause the indexer must search a number of buckets to find the data you'relooking for.

If the answer to this question is "NO" then you probably do not need to scaleyour deployment. However, adding additional indexers does improve bothindexing and search performance.

If the answer to this question is "YES" then you should definitely consider scalingyour deployment up. Read the following section to determine how Splunkcalculates storage.

Summary of performance recommendations

This topic summarizes the performance recommendations that were given in theperformance questionnaire. The table below shows the amount of referenceservers that are required to index and search data in Splunk, depending on thenumber of concurrent users and amounts of data that the instance indexes.

As a reminder, the reference hardware is:

Intel x86 64-bit chip architecture• 2 CPUs, 4 cores per CPU (8 cores total), at least 2.5 Ghz per core• 8GB RAM• Disk subsystem capable of producing 800 IOPS• Standard 1Gb Ethernet NIC, optional 2nd NIC for a management network• Standard 64-bit Linux or Windows distribution•

For additional information about the reference server, read "Reference hardware"in this manual.

Important: The figures shown in the table below only account for the referenceserver in question performing a single task, such as either indexing or searching.If a server is performing both actions at the same time, performance can anddoes degrade depending on the amount of indexing and searching happening atthe time. The figures shown here are approximate guidelines only.

28

If you run Splunk apps, have higher indexing volumes, employ multiple orI/O-heavy searches, or need more concurrent users than this table shows, thenyou should scale your deployment as described in "Hardware capacity planningfor a distributed Splunk deployment" in the Distributed Deployment Manual.

If you need more guidance, contact Splunk.

DailyIndexingVolume

Number ofConcurrent Search

Users

RecommendedIndexers

RecommendedSearch Heads

< 2 GB/day < 2 1, shared N/A

2 GB/day to 100GB/day up to 4 1, dedicated N/A

100 GB/day to200 GB/day up to 8 2 1

Note: For indexing requirements greater than 100 GB per day, or for additionalconcurrent users, review the hardware capacity requirements in the DistributedDeployment Manual.

Answers

Have questions? Visit Splunk Answers to see what questions and answers otherSplunk users had about hardware and Splunk.

29

Install Splunk on Windows

Choose the user Splunk should run as

When you run the Splunk Windows installer, it presents you with the option toselect the user that Splunk will run as. Splunk strongly recommends you read thistopic before installing in order to understand the ramifications of choosing theuser type.

If you already know that the computer you're installing Splunk on will notaccess remote Windows data then you can proceed directly to "Install onWindows" in this manual (or, if you want to install using the command prompt,"Install on Windows via the command line."

If there is a possibility that you will need to access remote Windows data,or you are not sure, then read on - this topic contains important informationabout the user you should install Splunk as.

'Local System' user vs. 'other user'

The Splunk installer provides two ways to install Splunk: as the "Local System"user, or as another existing user on your Windows computer or network, whichyou designate.

If you install as the Local System user, Splunk gets access to all of the importantinformation on your local machine. However, the Local System user has noprivileges on other Windows machines by design.

If you intend to do any of the following things, then you must install Splunk as an"other user":

read Event Logs remotely• collect performance counters remotely• read network shares for log files• enumerate the Active Directory schema using Active Directory monitoring•

The user that you specify:

Must be a member of the Active Directory domain or forest you wish tomonitor.

•

30

Must be a member of the local Administrators group on the server you'reinstalling Splunk on.

•

Important: Splunk might not function properly if the user you specify is not alocal administrator on computers running versions of Windows prior to WindowsServer 2008.

If you're not sure which user Splunk should run as, speak with your Windowsdomain administrator about the best way to proceed. If you are the domainadministrator, then review "Considerations for deciding how to monitor remoteWindows data" in the Getting Data In Manual for additional information on how toconfigure the Splunk user with the access it needs.

Important: If you decide to change the user Splunk runs as after you haveinstalled, you must ensure that the new account:

Has the necessary resource access rights.• Is a member of the machine's local Administrators group.• Has "Full Control" permissions to the %SPLUNK_HOME% directory and all itssubdirectories.

•

Managed service accounts on Windows Server 2008 and Windows 7

If you run WIndows Server 2008, Windows Server 2008 R2 or Windows 7, andyour Active Directory domain has at least one Windows Server 2008 R2 domaincontroller, you can install Splunk as a managed service account (MSA).

The major benefits of using a MSA are:

Increased security from the isolation of accounts for services.• Administrators no longer need to manage the credentials or administerservice principle names (SPNs).

•

Administrators can delegate the administration of these accounts tonon-administrators.

•

Some important things to understand before installing Splunk with a MSA are:

The MSA requires the same permissions as a domain account on themachine that runs Splunk.

•

The MSA must be a local administrator on the machine that runs Splunk.• You cannot use the same account on different computers, as you wouldwith a domain account.

•

31

You must correctly configure and install the MSA on the machine that runsSplunk before you install Splunk on the machine. For information andinstructions on how to do this, review "Service Accounts Step-by-StepGuide"(http://technet.microsoft.com/en-us/library/dd548356%28WS.10%29.aspx)on MS Technet.

•

To install Splunk using a MSA:

1. Ensure that the MSA you plan to use is properly configured for the Windowsresources you want to monitor.

2. Install Splunk from the command line as the "Local System" user.

Important: You must install Splunk from the command line and use theLAUNCHSPLUNK=0 flag to keep Splunk from starting after installation is completed.

3. After installation is complete, use the Windows Explorer or the ICACLScommand line utility to grant the MSA "Full Control" permissions to the Splunkinstallation directory and all its sub-directories.

Note: You might need to break any NTFS permission inheritance from parentdirectories above the Splunk installation directory and explicitly assignpermissions from that directory and all subdirectories.

4. Follow the instructions in the topic "Correct the user selected during Windowsinstallation" in this manual to change the default user for Splunk's serviceaccount. In this instance, the correct user is the MSA you configured prior toinstalling Splunk.

Important: You must append a dollar sign ($) to the end of the username whencompleting Step 4 in order for the MSA to work correctly. For example, if theMSA is SPLUNKDOCS\splunk1, then you must enter SPLUNKDOCS\splunk1$ in theappropriate field in the properties dialog for the service. You must do this for boththe splunkd and splunkweb services.

5. Confirm that the MSA has the "Log on as a service" right.

Note: If you use the Services control panel to make the service accountchanges, Windows grants this right to the MSA automatically.

6. Start Splunk. Splunk will run as the MSA configured above, and will haveaccess to all data the MSA has access to.

32

Security and remote access considerations

In the interests of security, Splunk strongly recommends that you take thefollowing steps when assigning security permissions for a Splunk user:

1. Create a domain group that the Splunk user will be a member of. 2. Place theuser Splunk runs as into this group. 3. Place that group into local groups onmember servers or workstations.

For example, if you want the user Splunk runs as to access performance logs onserver SERVER5, you would do the following:

1. In Active Directory Users and Computers, create a new domain groupSplunk.

2. Place the user Splunk runs as into the Splunk group.

3. On the SERVER5 server, add the Splunk group to the local Performance LogUsers group. The Splunk user then has access to the performance logs onSERVER5.

This helps maintain security integrity and makes it a lot easier to control accessin the event of a breach or site-wide security change.

Minimum permissions required to run Splunk as a user other than LocalSystem

If you choose to install Splunk as a domain user, then there are a minimumnumber of permissions required on the server that runs Splunk.

The following is a list of the minimum local permissions required for the splunkdand splunkweb services, when Splunk is installed using a domain user.Depending on the sources of data you want to access, the Splunk user mightneed a significant amount of additional permissions.

Required basic permissions for the splunkd service:

Full control over Splunk's installation directory• Read access to any flat files you want to index•

Required Local Security Policy user rights assignments for the splunkdservice:

33

Permission to log on as a service• Permission to log on as a batch job• Permission to replace a process-level token• Permission to act as part of the operating system• Permission to bypass traverse checking•

Required basic permissions for the splunkweb service:

Full control over Splunk's installation directory•

Required Local Security Policy user rights assignments for the splunkwebservice:

Permission to log on as a service•

Note: These permissions are not required when Splunk runs as the LocalSystem account.

Use Group Policy to assign user rights to multiple machines

If you want to assign the policy settings shown above to a number ofworkstations and servers in your AD domain or forest, you can define a GroupPolicy object (GPO) with these specific rights, and deploy that GPO across thedomain or forest.

Once you've created and enabled the GPO, the workstations and memberservers in your domain will pick up the changes either during the next scheduledAD replication cycle (usually every 2-3 hours) or at the next boot time.Alternatively, you can force AD replication using the standard AD command-linetools.

Remember that identical Local Security Policy user rights defined on aworkstation or member server are overridden by the rights inherited from a GPO,and you can't change this setting. If you wish to retain previously existing rightsthat are explicitly defined through Local Security Policy on your member servers,they'll also need to be assigned within the GPO.

Troubleshoot permissions issues

The rights described above are the rights that the splunkd and splunkwebservices specifically invoke. Other rights might be required, depending on yourusage and what data you want to access. Additionally, many user rightsassignments and other Group Policy restrictions can prevent Splunk from

34

running. If you have issues, consider using a tool such as Process Monitor totroubleshoot your environment.

You can use the GPRESULT command line tool or the Group Policy ManagementConsole (GPMC - in Windows Server 2008 or later) to troubleshoot issuesrelated to GPO application in your enterprise. As a last resort, you can revert torunning the splunkd service under a domain administrator or equivalent account.

If you accidentally specify the wrong user the first time you install

If you specified the wrong user during the installation procedure, you'll see twopop-up error dialogs telling you this. Complete the installation and then review"Correct the user selected during Windows installation" to switch to the correctuser. You must not start Splunk before doing this.

Install on Windows

This topic describes the procedure for installing Splunk on Windows with theGraphical User Interface (GUI)-based installer. More options (such as silentinstallation) are available if you install from the command line. Before installing,be sure to read "Choose the user Splunk should run as" to determine which useraccount Splunk should run as to address your specific needs.

Important: Running the 32-bit version of Splunk for Windows on a 64-bitWindows system is not recommended. If you attempt to run the 32-bit installer ona 64-bit system, the installer will warn you of this.

If you can run 64-bit Splunk on 64-bit hardware, we strongly recommend it. Theperformance is greatly improved over the 32-bit version.

Upgrading?

If you are upgrading, review "How to upgrade Splunk" for instructions andmigration considerations before proceeding.

Splunk for Windows and anti-virus software

Splunk's indexing subsystem requires lots of disk throughput. Any software with adevice driver that intermediates between Splunk and the operating system canrob Splunk of processing power, causing slowness and even an unresponsivesystem. This includes anti-virus software.

35

It's extremely important to configure such software to avoid on-access scanningof Splunk installation directories and processes, before starting a Splunkinstallation.

Install Splunk via the GUI installer

The Windows installer is an MSI file.

1. To start the installer, double-click the splunk.msi file.

The installer displays the Welcome panel.

2. To begin the installation, click Next.

Note: On each panel, you can click Next to continue, Back to go back a step, orCancel to close the installer.

The installer displays the licensing panel.

3. Read the licensing agreement and select "I accept the terms in the licenseagreement". Click Next to continue installing.

The installer displays the Destination Folder panel.

Note: Splunk is installed by default into \Program Files\Splunk on the systemdrive. Splunk's installation directory is referred to as $SPLUNK_HOME or%SPLUNK_HOME% throughout this documentation set.

4. Click Change... to specify a different location to install Splunk, or click Next toaccept the default value.

The installer displays the Logon Information panel.

Splunk installs and runs two Windows services, splunkd and splunkweb. Theseservices will be installed and run as the user you specify on this panel. You canchoose to run Splunk with Local System credentials, or provide a specificaccount. That account should have local administrator privileges, plusappropriate domain permissions if you are collecting data from other machines.

Important: Read "Choose the user Splunk should run as" for additionalinformation on what type of user you should install your Splunk instance with.

5. Select a user type and click Next.

36

If you specified the local system user, proceed to step 7. Otherwise, the installerdisplays the Logon Information: specify a username and password panel.

6. Specify a username and password to install and run Splunk and click Next.

Note: This must be a valid user in your security context. Splunk cannot startwithout a valid username and password.

The installer displays the pre-installation summary panel.

7. Click Install to proceed.

The installer runs and displays the Installation Complete panel.

Caution: If you specified the wrong user during the installation procedure, youwill see two pop-up error windows explaining this. If this occurs, Splunk installsitself as the local system user by default. Splunk will not start automatically in thissituation. You can proceed through the final panel of the installation, but uncheckthe "Launch browser with Splunk" checkbox to prevent your browser fromlaunching. Then, use these instructions to switch to the correct user beforestarting Splunk.

8. If desired, check the boxes to Launch browser with Splunk and Create StartMenu Shortcut now. Click Finish.

The installation completes, Splunk starts, and Splunk Web launches in asupported browser if you checked the appropriate box.

Note: The first time you access Splunk Web after installation, login with thedefault username admin and password changeme. Do not use the username andpassword you provided during the installation process.

Launch Splunk in a Web browser

To access Splunk Web after you start Splunk on your machine, you can either:

Click the Splunk icon in Start > Programs > Splunk•

or

Open a Web browser and navigate to http://localhost:8000.•

Log in using the default credentials: username: admin and password: changeme.

37

The first time you log into Splunk successfully, you'll be prompted right away tochange your password. You can do so by entering a new password and clickingthe Change password button, or you can do it later by clicking the Skip button.

Note: If you do not change your password, remember that anyone who hasaccess to the machine can access your Splunk instance. Be sure to change theadmin password as soon as possible and make a note of what you changed it to.

Avoid IE Enhanced Security pop-ups

If you're using Internet Explorer to access Splunk, add the following URLs to theallowed Intranet group or fully trusted group to avoid getting "Enhanced Security"pop-ups:

quickdraw.splunk.com• the URL of your Splunk instance•

Change the Splunk Web or splunkd service ports

If you want the Splunk Web service or the splunkd service to use a different port,you can change the defaults.

To change the splunk web service port:

Open a command prompt.• Change to the %SPLUNK_HOME%\bin directory.• Type in splunk set web-port #### and press Enter.•

To change the splunkd port:

Open a command prompt, if one isn't already.• Change to the %SPLUNK_HOME%\bin directory.• Type in splunk set splunkd-port #### and press Enter.•

Note: If you specify a port and that port is not available, or if the default port isunavailable, Splunk will automatically select the next available port.

Install or upgrade license

If you are performing a new installation of Splunk or switching from one licensetype to another, you must install or update your license.

38

What's next?

Now that you've installed Splunk, you can find out what comes next, or you canreview these topics in the Getting Data In Manual for information on addingWindows data to Splunk:

Monitor Windows Event Log data• Monitor Windows Registry data• Monitor WMI-based data• Considerations for deciding how to monitor remote Windows data.•

Install on Windows via the command line

This topic describes the procedure for installing Splunk on Windows from thecommand line. Before installing, be sure to read "Choose the user Splunk shouldrun as" to determine which user account Splunk should run as to address yourspecific needs.

Important: Running the 32-bit version of Splunk for Windows on a 64-bitWindows system is not recommended. If you run the 32-bit installer on a 64-bitsystem, the installer will warn you about this.

If you can run 64-bit Splunk on 64-bit hardware, we strongly recommend it. Theperformance is greatly improved over the 32-bit version.

Upgrading?

If you are upgrading, review "How to upgrade Splunk" for instructions andmigration considerations before proceeding.

In particular, be aware that Splunk does not support changing the managementor HTTP ports during an upgrade.

Splunk for Windows and anti-virus software

Splunk's indexing subsystem requires lots of disk throughput. Anti-virus software- or any software with a device driver that intermediates between Splunk and theoperating system - can rob Splunk of processing power, causing slowness andeven an unresponsive system.

39

It's extremely important to configure such software to avoid on-access scanningof Splunk installation directories and processes, before starting a Splunkinstallation.

Install Splunk from the command line

You can install Splunk from the command line by invoking msiexec.exe.

For 32-bit platforms, use splunk-<...>-x86-release.msi:

msiexec.exe /i splunk-<...>-x86-release.msi [<flag>]... [/quiet]

For 64-bit platforms, use splunku-<...>-x64-release.msi:

msiexec.exe /i splunk-<...>-x64-release.msi [<flag>]... [/quiet]

The value of <...> varies according to the particular release; for example,splunk-5.0-125454-x64-release.msi.

Command line flags allow you to configure Splunk at installation time. Usingcommand line flags, you can specify a number of settings, including:

Which Windows event logs to index.• Which Windows Registry hive(s) to monitor.• Which Windows Management Instrumentation (WMI) data to collect.• The user Splunk runs as (Important: Read "Choose the user Splunkshould run as" for information on what type of user you should install yourSplunk instance with.)

•

An included application configuration for Splunk to enable (such as theSplunk light forwarder.)

•

Whether or not Splunk should start up automatically when the installationis completed.

•

Note: The first time you access Splunk Web after installation, log in with thedefault username admin and password changeme.

Supported flags

The following is a list of the flags you can use when installing Splunk forWindows via the command line.

40

Important: The Splunk universal forwarder is a separate executable, with its owninstallation flags. Review the supported installation flags for the universalforwarder in "Deploy a Windows universal forwarder from the command line" inthe Distributed Deployment Manual.

Flag What it's for Default

INSTALLDIR="<directory_path>"

Use this flag to specify directory to install.Splunk's installation directory is referred to as$SPLUNK_HOME or %SPLUNK_HOME%throughout this documentation set.

C:\ProgramFiles\Splunk

SPLUNKD_PORT=<port number>

Use these flags to specify alternate ports forsplunkd and splunkweb to use.

Note: If you specify a port and that portis not available, Splunk willautomatically select the next availableport.

8089

WEB_PORT=<port number>

Use these flags to specify alternate ports forsplunkd and splunkweb to use.

Note: If you specify a port and that portis not available, Splunk willautomatically select the next availableport.

8000

WINEVENTLOG_APP_ENABLE=1/0

WINEVENTLOG_SEC_ENABLE=1/0

WINEVENTLOG_SYS_ENABLE=1/0

WINEVENTLOG_FWD_ENABLE=1/0

WINEVENTLOG_SET_ENABLE=1/0

Use these flags to specify whether or notSplunk should index a particular Windows eventlog:

Application log

Security log

System log

Forwarder log

Setup log

Note: You can specify multiple flags.

0 (off)

REGISTRYCHECK_U=1/0

Use this flag to specify whether or not Splunkshould

0 (off)

41

REGISTRYCHECK_BASELINE_U=1/0 index events from

capture a baseline snapshot of

the Windows Registry user hive(HKEY_CURRENT_USER).

Note: You can set both of these at thesame time.

REGISTRYCHECK_LM=1/0

REGISTRYCHECK_BASELINE_LM=1/0

Use this flag to specify whether or not Splunkshould

index events from

capture a baseline snapshot of

the Windows Registry machine hive(HKEY_LOCAL_MACHINE).

Note: You can set both of these at thesame time.

0 (off)

WMICHECK_CPUTIME=1/0

WMICHECK_LOCALDISK=1/0

WMICHECK_FREEDISK=1/0

WMICHECK_MEMORY=1/0

Use these flags to specify which popularWMI-based performance metrics Splunk shouldindex:

CPU usage

Local disk usage

Free disk space

Memory statistics

Caution: If you need this instance ofSplunk to monitor remote Windowsinstances over WMI, then you mustalso specify the LOGON_USERNAME andLOGON_PASSWORD installation flags.Splunk can not collect any remoteWMI-based data that it does not haveexplicit access to. Read "Choose theuser Splunk should run as" in thismanual for additional information about

0 (off)

42

the required credentials.

Note: There are many moreWMI-based metrics that Splunk canindex. Review "Monitor WMI Data" inthe Getting Data In Manual for specificinformation.

LOGON_USERNAME="<domain\username>"

LOGON_PASSWORD="<pass>"

Use these flags to provide domain\usernameand password information for the user thatSplunk will run as. The plunked andsplunkweb services are configured withthese credentials. For theLOGON_USERNAME flag, you must specifythe domain with the username in theformat "domain\username."

These flags are required if you wantthis Splunk installation to monitor anyremote WMI-based data. Review"Choose the user Splunk should run as"in this manual for additional informationabout which credentials to use.

none

SPLUNK_APP="<SplunkApp>" Use this flag to specify an included Splunkapplication configuration to enable for thisinstallation of Splunk. Currently supportedoptions for <SplunkApp> are:SplunkLightForwarder andSplunkForwarder. These specify thatthis instance of Splunk will function as alight forwarder or heavy forwarder,respectively. Refer to the "Aboutforwarding and receiving" topic in theDistributed Deployment manual formore information.

Important: The universal forwarder isnot enabled from full Splunk; it is aseparate downloadable executable,with its own installation flags.

Note: If you specify either the Splunkforwarder or light forwarder here, youmust also specify

none

43

FORWARD_SERVER="<server:port>".

To install Splunk with no applications atall, simply omit this flag.

FORWARD_SERVER="<server:port>"

Use this flag *only* when you are also using theSPLUNK_APP flag to enable either theSplunk heavy or light forwarder. Specifythe server and port of the Splunk serverto which this forwarder will send data.

Important: This flag requires that theSPLUNK_APP flag also be set.

none

DEPLOYMENT_SERVER="<host:port>"

Use this flag to specify a deployment server forpushing configuration updates. Enter thedeployment server's name (hostname or IPaddress) and port.

none

LAUNCHSPLUNK=0/1

Use this flag to specify whether or not Splunkshould start up automatically on system boot.

Important: If you enable the SplunkForwarder by using the SPLUNK_APP flag,Splunk is configured to startautomatically, and this flag is ignored.

1 (on)

Silent installation

To run the installation silently, add /quiet to the end of your installationcommand string. If your system is running UAC (which is sometimes on bydefault) you must run the installation as Administrator. To do this: when openinga cmd prompt, right click and select "Run As Administrator". Then use this cmdwindow to run the silent install command.

Examples

The following are some examples of using different flags.

Silently install Splunk to run as the Local System user

msiexec.exe /i Splunk.msi /quiet

44

Enable SplunkForwarder and specify credentials for the user Splunk willrun as

msiexec.exe /i Splunk.msi SPLUNK_APP="SplunkForwarder"FORWARD_SERVER="<server:port>" LOGON_USERNAME="AD\splunk"LOGON_PASSWORD="splunk123"

Enable SplunkForwarder, enable indexing of the Windows System eventlog, and run the installer in silent mode

msiexec.exe /i Splunk.msi SPLUNK_APP="SplunkForwarder"FORWARD_SERVER="<server:port>" WINEVENTLOG_SYS_ENABLE=1 /quiet

Where "<server:port>" are the server and port of the Splunk server to whichthis machine should send data.

Launch Splunk in a Web browser

To access Splunk Web after you start Splunk on your machine, you can either:

Click the Splunk icon in Start>Programs>Splunk•

or

Open a Web browser and navigate to http://localhost:8000.•

Log in using the default credentials: username: admin and password: changeme .Be sure to change the admin password as soon as possible and make a note ofwhat you changed it to.

Now that you've installed Splunk, what comes next?

Avoid IE Enhanced Security pop-ups

To avoid IE Enhanced Security pop-ups, add the following URLs to the allowedIntranet group or fully trusted group in IE:

quickdraw.splunk.com• the URL of your Splunk instance•

45

Install or upgrade license

If you are performing a new installation of Splunk or switching from one licensetype to another, you must install or update your license.

What's next?

Now that you've installed Splunk, what comes next?

You can also review this topic about considerations for deciding how to monitorWindows data in the Getting Data In manual.

Correct the user selected during Windowsinstallation

If you have selected "other user" during the Windows GUI installation, and thatuser does not exist or perhaps you mistyped the information, you can go into theWindows Service Control Manager and specify the correct information, as longas you have not started Splunk yet. If you have started Splunk, you must stopit, uninstall it and reinstall it.

If you specified an invalid user during the Windows GUI installation process, youwill see two popup error windows.

To change the user:

1. In Control Panel > Administrative Tools > Services, find the Splunkd andSplunkWeb services. You'll notice that they are not started and are currentlyowned by the Local System User.

2. Right click on each service and choose Properties. The properties dialog forthat service is displayed.

3. Select the Log On tab.

4. Select the This account radio button and fill in the correct domain\usernameand password.

5. Click Apply.

6. Click OK.

46

7. Repeat Steps 2 through 6 for the second service (you must do this for bothSplunkd and Splunk Web).

8. You can now either start both services from the Service Manager or from theSplunk command line interface.

47

Install Splunk on Unix, Linux or Mac OS X

Install on Linux

You can install Splunk on Linux using RPM or DEB packages, or a tar file.

Upgrading?

If you are upgrading, review "How to upgrade Splunk" for instructions andmigration considerations before proceeding.

RedHat RPM install

To install the Splunk RPM in the default directory /opt/splunk:

rpm -i splunk_package_name.rpm

To install Splunk in a different directory, use the --prefix flag:

rpm -i --prefix=/opt/new_directory splunk_package_name.rpm

To upgrade an existing Splunk installation that resides in /opt/splunk using theRPM:

rpm -U splunk_package_name.rpm

To upgrade an existing Splunk installation that was done in a different directory,use the --prefix flag:

rpm -U --prefix=/opt/existing_directory splunk_package_name.rpm

Note: If you do not specify with --prefix for your existing directory, rpm willinstall in the default location of /opt/splunk.

For example, to upgrade to the existing directory of$SPLUNK_HOME=/opt/apps/splunk enter the following:

48

rpm -U --prefix=/opt/apps splunk_package_name.rpm

If you want to automate your RPM install with kickstart, add the following to yourkickstart file:

./splunk start --accept-license

./splunk enable boot-start

Note: The second line is optional for the kickstart file.

Debian DEB install

To install the Splunk DEB package:

dpkg -i splunk_package_name.deb

Note: You can only install the Splunk DEB package in the default location,/opt/splunk.

tar file install

To install Splunk from a tar file on a Linux system, expand the tar file into anappropriate directory. The default install directory is /opt/splunk.

When you install with the tar file:

Splunk does not create the splunk user automatically. If you want Splunkto run as a specific user, you must create the user manually.

•

Be sure the disk partition has enough space to hold the uncompressedvolume of the data you plan to keep indexed.

•

What gets installed

Splunk package status:

dpkg --status splunk

List all packages:

dpkg --list

49

Start Splunk

Splunk can run as any user on the local system. If you run Splunk as a non-rootuser, make sure that Splunk has the appropriate permissions to read the inputsthat you specify. Refer to the instructions for running Splunk as a non-root userfor more information.

To start Splunk from the command line interface, run the following commandfrom $SPLUNK_HOME/bin directory (where $SPLUNK_HOME is the directory intowhich you installed Splunk):

./splunk start

By convention, this document uses:

$SPLUNK_HOME to identify the path to your Splunk installation.• $SPLUNK_HOME/bin/ to indicate the location of the command line interface.•

Startup options

The first time you start Splunk after a new installation, you must accept thelicense agreement. To start Splunk and accept the license in one step:

$SPLUNK_HOME/bin/splunk start --accept-license

Note: There are two dashes before the accept-license option.

Launch Splunk Web and log in

After you start Splunk and accept the license agreement,

1. In a browser window, access Splunk Web at http://<hostname>:port.

hostname is the host machine.• port is the port you specified during the installation (the default port is8000).

•

2. Splunk Web prompts you for login information (default, username admin andpassword changeme) before it launches. If you switch to Splunk Free, you willbypass this logon page in future sessions.

50

What's next?

Now that you've installed Splunk, what comes next?

RedHat Linux

To uninstall from RedHat Linux

rpm -e splunk_product_name

Debian Linux

To uninstall from Debian Linux:

dpkg -r splunk

To purge (delete everything, including configuration files):

dpkg -P splunk

Install on Solaris

You can install Splunk on Solaris with a PKG packages, or a tar file.

Upgrading?

If you are upgrading, review "How to upgrade Splunk" for instructions andmigration considerations before proceeding.

Install Splunk

Splunk for Solaris is available as a PKG file or a tar file.

PKG file install

The PKG installation package includes a request file that prompts you to answera few questions before Splunk installs.

51

pkgadd -d ./splunk_product_name.pkg

A list of the available packages is displayed.

Select the packages you wish to process (the default is "all").•

The installer then prompts you to specify a base installation directory.

To install into the default directory, /opt/splunk, leave this blank.•

PKG file upgrade

To upgrade an existing Splunk installation using a PKG file, you should use theinstance parameter, either in the system's default package installationconfiguration file (/var/sadm/install/admin/default) or in a customconfiguration file that you define and call.

In the default or custom configuration file, set instance=overwrite. This willprevent the upgrade from creating a second splunk package (withinstance=unique), or failing (with instance=quit). For information about theinstance parameter, see the Solaris man page (man -s4 admin).

To upgrade Splunk using the system's default package installation file, use thesame command line as you would for a fresh install.

pkgadd -d ./splunk_product_name.pkg

You will be prompted to overwrite any changed files, answer yes to every one.

To upgrade using a custom configuration file, type:

pkgadd -a conf_file -d ./splunk_product_name.pkg

To run the upgrade silently (and not have to answer yes for every file overwrite),type:

pkgadd -n -d ./splunk_product_name.pkg

52

tar file install

To install Splunk on a Solaris system, expand the tar file into an appropriatedirectory. By default, Splunk installs into /opt/splunk/.

When you install with the tar file:

Splunk does not create the splunk user automatically. If you want Splunkto run as a specific user, you must create the user manually.

•

Be sure the disk partition has enough space to hold the uncompressedvolume of the data you plan to keep indexed.

•

What gets installed

Splunk package info:

pkginfo -l splunk

List all packages:

pkginfo

Start Splunk

Splunk can run as any user on the local system. If you run Splunk as a non-rootuser, make sure that Splunk has the appropriate permissions to read the inputsthat you specify. For more information, refer to the instructions on running Splunkas a non-root user.

To start Splunk from the command line interface, run the following commandfrom $SPLUNK_HOME/bin directory (where $SPLUNK_HOME is the directory intowhich you installed Splunk):

./splunk start

By convention, Splunk's documentation uses:

$SPLUNK_HOME to identify the path to your Splunk installation.• $SPLUNK_HOME/bin/ to indicate the location of the command line interface.•

53

Startup options

The first time you start Splunk after a new installation, you must accept thelicense agreement. To start Splunk and accept the license in one step:

$SPLUNK_HOME/bin/splunk start --accept-license

Note: There are two dashes before the accept-license option.

Launch Splunk Web and log in

After you start Splunk and accept the license agreement,

1. In a browser window, access Splunk Web at http://mysplunkhost:port, where:

mysplunkhost is the host machine.• port is the port you specified during the installation (8000).•

2. Splunk Web prompts you for login information (default, username admin andpassword changeme) before it launches. If you switch to Splunk Free, you willbypass this logon page in future sessions.

What's next?

Now that you've installed Splunk, what comes next?

Install on Mac OS

You can install Splunk on Mac OS X using a DMG package, or a tar file.

Upgrading?

If you are upgrading, review "How to upgrade Splunk" for instructions andmigration considerations before proceeding.

Installation options

The Mac OS build comes in two forms: a DMG package and a tar file. Below areinstructions for the:

54

Graphical (basic) and command line installs using the DMG file.• tar file install.•

Note: if you require two installations in different locations on the same host, usethe tar file. The pkg installer cannot install a second instance. If one exists, it willremove it upon successful install of the second.

Graphical install

1. Double-click on the DMG file.

A Finder window containing splunk.pkg opens.

2. In the Finder window, double-click on splunk.pkg.

The Splunk installer opens and displays the Introduction, which lists version andcopyright information.

3. Click Continue.

The Select a Destination window opens.

4. Choose a location to install Splunk.

To install in the default directory, /Applications/splunk, click on theharddrive icon.

•

To select a different location, click Choose Folder...•

5. Click Continue.

The pre-installation summary displays. If you need to make changes,

Click Change Install Location to choose a new folder, or• Click Back to go back a step.•

6. Click Install.

Your installation will begin. It may take a few minutes.

7. When your install completes, click Finish.

55

Command line install

1. To mount the dmg:

hdid splunk_package_name.dmg

2. To Install

To the root volume:•

installer -pkg splunk.pkg -target /

To a different disk of partition:•

installer -pkg splunk.pkg -target /Volumes\ Disk

-target specifies a target volume, such as another disk, where Splunk will beinstalled in /Applications/splunk.

To install into a directory other than /Applications/splunk on any volume, usethe graphical installer as described above.

tar file install

To install Splunk on a Mac OS, expand the tar file into an appropriate directory.The default install directory is /Applications/splunk.

When you install with the tar file:

Splunk does not create the splunk user automatically. If you want Splunkto run as a specific user, you must create the user manually.

•

Be sure the disk partition has enough space to hold the uncompressedvolume of the data you plan to keep indexed.

•

Start Splunk

Splunk can run as any user on the local system. If you run Splunk as a non-rootuser, make sure that Splunk has the appropriate permissions to read the inputsthat you specify.

56

To start Splunk from the command line interface, run the following commandfrom $SPLUNK_HOME/bin directory (where $SPLUNK_HOME is the directory intowhich you installed Splunk):

./splunk start

By convention, this document uses:

$SPLUNK_HOME to identify the path to your Splunk installation.• $SPLUNK_HOME/bin/ to indicate the location of the command line interface.•

Startup options

The first time you start Splunk after a new installation, you must accept thelicense agreement. To start Splunk and accept the license in one step:

$SPLUNK_HOME/bin/splunk start --accept-license

Note: There are two dashes before the accept-license option.

Launch Splunk Web and log in

After you start Splunk and accept the license agreement,

1. In a browser window, access Splunk Web at http://<hostname>:port

hostname is the host machine.• port is the port you specified during the installation (the default port is8000).

•

2. Splunk Web prompts you for login information (default, username admin andpassword changeme) before it launches. If you switch to Splunk Free, you willbypass this logon page in future sessions.

What's next?

Now that you've installed Splunk, what comes next?

57

Manage your license

If you are performing a new installation of Splunk or switching from one licensetype to another, you must install or update your license.

Install on FreeBSD

The FreeBSD builds comes in two forms: an installer (5.4-intel) and a tar file(i386). Both are gzipped tar file (.tgz) files.

Upgrading?

If you are upgrading, review "How to upgrade Splunk" for instructions andmigration considerations before proceeding.

Prerequisites

For FreeBSD 8 , Splunk requires compatibility packages. To install thecompatibility package:

1. Install the port:

portsnap fetch update

cd /usr/ports/misc/compat7x/ && make install clean

2. Add the package:

pkg_add -r compat7x-amd64

Basic install

To install FreeBSD using the intel installer:

pkg_add splunk_package_name-6.1-intel.tgz

Important: This installs Splunk in the default directory, /opt/splunk. If /opt doesnot exist, you will need to create it prior to running the install command. If youdon't, you might receive an error message. Splunk recommends that you createa symbolic link to another filesystem and install Splunk there, since bestpractices for FreeBSD maintain a small root ("/") filesystem.

58

To install Splunk in a different directory:

pkg_add -v -p /usr/splunk splunk_package_name-6.1-intel.tgz

The FreeBSD package system does not have native upgrade support. There aresome add-on utilities which try to manage it, but this is not explicitly tested. Toupgrade a package on FreeBSD you can either uninstall the prior package, andinstall the new package, or you can upgrade the existing installation using a tarfile install as below.

tar file install

To install Splunk on a FreeBSD system, expand the tar file into an appropriatedirectory. The default install directory is /opt/splunk.

When installing with the tar file:

Splunk does not create the splunk user automatically. If you want Splunkto run as a specific user, you must create the user manually.

•

Be sure the disk partition has enough space to hold the uncompressedvolume of the data you plan to keep indexed.

•

After you install

To ensure that Splunk functions properly on FreeBSD, you must:

1. Add the following to /boot/loader.conf

kern.maxdsiz="2147483648" # 2GBkern.dfldsiz="2147483648" # 2GBmachdep.hlt_cpus=0

2. Add the following to /etc/sysctl.conf:

vm.max_proc_mmap=2147483647

A restart of the OS is required for the changes to effect.

If your server has less than 2 GB of memory, reduce the values accordingly.

59

What gets installed

To see the list of Splunk packages:

pkg_info -L splunk

To list all packages:

pkg_info

Start Splunk

Splunk can run as any user on the local system. If you run Splunk as a non-rootuser, make sure that Splunk has the appropriate permissions to read the inputsthat you specify.

To start Splunk from the command line interface, run the following commandfrom $SPLUNK_HOME/bin directory (where $SPLUNK_HOME is the directory intowhich you installed Splunk):

./splunk start

By convention, this document uses:

$SPLUNK_HOME to identify the path to your Splunk installation.• $SPLUNK_HOME/bin/ to indicate the location of the command line interface.•

Startup options

The first time you start Splunk after a new installation, you must accept thelicense agreement. To start Splunk and accept the license in one step:

$SPLUNK_HOME/bin/splunk start --accept-license

Note: There are two dashes before the accept-license option.

Launch Splunk Web and log in

After you start Splunk and accept the license agreement,

60

1. In a browser window, access Splunk Web at http://<hostname>:port

hostname is the host machine.• port is the port you specified during the installation (the default port is8000).

•

2. Splunk Web prompts you for login information (default, username admin andpassword changeme) before it launches. If you switch to Splunk Free, you willbypass this logon page in future sessions.

What's next?

Now that you've installed Splunk, what comes next?

Manage your license

If you are performing a new installation of Splunk or switching from one licensetype to another, you must install or update your license.

Install on AIX

You can install Splunk on AIX using a tar file.

Important: The user Splunk is installed as must have permission to read/dev/urando and /dev/random or the installation will fail.

Upgrading?

If you are upgrading, review "How to upgrade Splunk" for instructions andmigration considerations before proceeding.

Install Splunk

The AIX install comes in tar file form.

When you install with the tar file:

Splunk does not create the splunk user automatically. If you want Splunkto run as a specific user, you must create the user manually.

•

Be sure the disk partition has enough space to hold the uncompressedvolume of the data you plan to keep indexed.

•

61

We recommend you use GNU tar to unpack the tar files, as AIX tar can failto unpack long file names, fail to overwrite files, and other problems. If youmust use the system tar, be sure to check the output for error messages.

•

To install Splunk on an AIX system, expand the tar file into an appropriatedirectory. The default install directory is /opt/splunk.

For AIX 5.3, check to make sure your service packs are up to date. Splunkrequires the following service level:

$ oslevel -r5300-005

Start Splunk

Splunk can run as any user on the local system. If you run Splunk as a non-rootuser, make sure that Splunk has the appropriate permissions to read the inputsthat you specify. Refer to the instructions for running Splunk as a non-root userfor more information.

To start Splunk from the command line interface, run the following commandfrom $SPLUNK_HOME/bin directory (where $SPLUNK_HOME is the directory intowhich you installed Splunk):

./splunk start

By convention, this document uses:

$SPLUNK_HOME to identify the path to your Splunk installation.• $SPLUNK_HOME/bin/ to indicate the location of the command line interface.•

Note: The AIX version of Splunk does not register itself to auto-start on reboot.

Startup options

The first time you start Splunk after a new installation, you must accept thelicense agreement. To start Splunk and accept the license in one step:

$SPLUNK_HOME/bin/splunk start --accept-license

Note: There are two dashes before the accept-license option.

62

For more information, refer to "Splunk startup options" in this manual.

Launch Splunk Web and log in

After you start Splunk and accept the license agreement,

1. In a browser window, access Splunk Web at http://<hostname>:port

hostname is the host machine.• port is the port you specified during the installation (the default port is8000).

•

2. Splunk Web prompts you for login information (default, username admin andpassword changeme) before it launches. If you switch to Splunk Free, you willbypass this logon page in future sessions.

What's next?

Now that you've installed Splunk, what comes next?

Manage your license

If you are performing a new installation of Splunk or switching from one licensetype to another, you must update your license.

Install on HP-UX

You can install Splunk on HP/UX using a tar file.

To install Splunk on an HP-UX system, expand the tar file, using GNU tar, into anappropriate directory. The default install directory is /opt/splunk.

NOTE: The system default tar on HP-UX will not successfully extract the splunktar. GNU tar is a pre-requisite, or you can unpack the tar on another platform.

When you install with the tar file:

Splunk does not create the splunk user automatically. If you want Splunkto run as a specific user, you must create the user manually.

•

Be sure the disk partition has enough space to hold the uncompressedvolume of the data you plan to keep indexed.

•

63

Upgrading?

If you are upgrading, review "How to upgrade Splunk" for instructions andmigration considerations before proceeding.

Start Splunk

Splunk can run as any user on the local system. If you run Splunk as a non-rootuser, make sure that Splunk has the appropriate permissions to read the inputsthat you specify.

To start Splunk from the command line interface, run the following commandfrom $SPLUNK_HOME/bin directory (where $SPLUNK_HOME is the directory intowhich you installed Splunk):

./splunk start

By convention, this document uses:

$SPLUNK_HOME to identify the path to your Splunk installation.• $SPLUNK_HOME/bin/ to indicate the location of the command line interface.•

Note: The HP-UX version of Splunk does not register itself to auto-start onreboot.

Startup options

The first time you start Splunk after a new installation, you must accept thelicense agreement. To start Splunk and accept the license in one step:

$SPLUNK_HOME/bin/splunk start --accept-license

Note: There are two dashes before the accept-license option.

Launch Splunk Web and log in

After you start Splunk and accept the license agreement,

1. In a browser window, access Splunk Web at http://<hostname>:port

hostname is the host machine.•

64

port is the port you specified during the installation (the default port is8000).

•

2. Splunk Web prompts you for login information (default, username admin andpassword changeme) before it launches. If you switch to Splunk Free, you willbypass this logon page in future sessions.

What's next?

Now that you've installed Splunk, what comes next?

Manage your license

If you are performing a new installation of Splunk or switching from one licensetype to another, you must install or update your license.

Run Splunk as a different or non-root user

Important: This topic is for non-Windows operating systems only. To learn howto install Splunk on Windows using a user, read "Choose the user Splunk shouldrun as" in this manual.

You can run Splunk as any user on the local system. If you run Splunk as anon-root user, make sure Splunk has the appropriate permissions to:

Read the files and directories it is configured to watch. Some log files anddirectories may require root or superuser access to be indexed.

•

Write to Splunk's directory and execute any scripts configured to work withyour alerts or scripted input.

•

Bind to the network ports it is listening on (ports below 1024 are reservedports that only root can bind to).

•

Note: Because ports below 1024 are reserved for root access only, Splunk willonly be able to listen on port 514 (the default listening port for syslog) if it isrunning as root. You can, however install another utility (such as syslog-ng) towrite your syslog data to a file and have Splunk monitor that file instead.

Instructions

To run Splunk as a non-root user, you need to first install Splunk as root. Then,before you start Splunk for the first time, change the ownership of the splunk

65

directory to the desired user. The following are instructions to install Splunk andrun it as a non-root user, splunk.

Note: In the following examples, $SPLUNK_HOME represents the path to the Splunkinstallation directory.

1. Create the user and group, splunk.

For Linux, Solaris, and FreeBSD:

useradd splunkgroupadd splunk

For Mac OS:

You can use the System Preferences > Accounts panel to add users andgroups.

2. As root and using one of the packages (not a tar file), run the installation.

Important: Do not start Splunk yet.

3. Use the chown command to change the ownership of the splunk directory andeverything under it to the desired user.

chown -R splunk $SPLUNK_HOME

4. Start Splunk.

$SPLUNK_HOME/bin/splunk start

Also, if you want to start Splunk as the splunk user while you are logged in as adifferent user, you can use the sudo command:

sudo -H -u splunk $SPLUNK_HOME/bin/splunk start

This example command assumes:

If Splunk is installed in an alternate location, update the path in thecommand accordingly.

•

66

Your system may not have sudo installed. If this is the case, you can usesu.

•

If you are installing using a tar file and want Splunk to run as a particularuser (such as splunk), you must create that user manually.

•

The splunk user will need access to /dev/urandom to generate the certsfor the product.

•

Solaris 10 privileges

When installing on Solaris 10 as the splunk user, you must set additionalprivileges to start splunkd and bind to reserved ports.

To start splunkd as the splunk user on Solaris 10, run:

# usermod -K defaultpriv=basic,net_privaddr,proc_exec,proc_fork splunk

To allow the splunk user to bind to reserved ports on Solaris 10, run (as root):

# usermod -K defaultpriv=basic,net_privaddr splunk

67

Start using Splunk

Start Splunk for the first time

To start Splunk:

On Windows

You can start Splunk on Windows using either the command line, or theWindows Services Manager. Using the command line offers more options,described later in this section. In a cmd window, go to C:\ProgramFiles\Splunk\bin and type:

splunk start

(For Windows users: in subsequent examples and information, replace$SPLUNK_HOME with C:\Program Files\Splunk if you have installed Splunk in thedefault location. You can also add %SPLUNK_HOME% as a system-wide environmentvariable by using the System Properties dialog's Advanced tab.)

On UNIX

Use the Splunk command-line interface (CLI):

$SPLUNK_HOME/bin/splunk start

Splunk then displays the license agreement and prompts you to accept beforethe startup sequence continues.

Other start options

To accept the license automatically when you start Splunk for the first time, addthe accept-license option to the start command:

$SPLUNK_HOME/bin/splunk start --accept-license

The startup sequence displays:

68

Checking prerequisites...Checking http port [8000]: openChecking mgmt port [8089]: openVerifying configuration. This may take a while...Finished verifying configuration.Checking index directory...Verifying databases...Verified databases: _audit, _blocksignature, _internal, _thefishbucket,history, main, sampledata, splunklogger, summaryChecking index filesAll index checks passed.All preliminary checks passed.Starting splunkd...Starting splunkweb...Splunk Server started.The Splunk web interface is at http://<hostname>:8000

Note: If the default ports are already in use (or are otherwise not available),Splunk will offer to use the next available port. You can either accept this optionor specify a port for Splunk to use.

There are two other start options: no-prompt and answer-yes:

If you run $SPLUNK_HOME/bin/splunk start --no-prompt, Splunk proceedswith startup until it requires you to answer a question. Then, it displays thequestion, why it is quitting, and quits.

•

If you run SPLUNK_HOME/bin/splunk start --answer-yes, Splunk proceedswith startup and automatically answers "yes" to all yes/no questions.Splunk displays the question and answer as it continues.

•

If you run start with all three options in one line, for example:

$SPLUNK_HOME/bin/splunk start --answer-yes --no-prompt --accept-license

Splunk does not ask you to accept the license.• Splunk answers yes to any yes/no question.• Splunk quits when it encounters a non-yes/no question.•

Start and disable individual processes

You can start and stop individual Splunk processes by adding the process as anobject to the start command. The objects include:

splunkd, the Splunk server daemon.•

69

splunkweb, Splunk's Web interface process.•

For example, to start only splunkd:

$SPLUNK_HOME/bin/splunk start splunkd

To disable splunkweb:

$SPLUNK_HOME/bin/splunk disable webserver

For more information about start, refer to the CLI help page:

$SPLUNK_HOME/bin/splunk help start

Launch Splunk Web

Navigate to:

http://mysplunkhost:8000

Use whatever host and port you chose during installation.

The first time you log in to Splunk Enterprise, the default login details are:Username - adminPassword - changeme

Splunk Free does not have access controls.

What happens next?

Now that you've got Splunk installed on one server, here are some links to getyou started:

Learn what Splunk is, what it does, and how it's different.• Learn how to add your data to Splunk.• Add and manage users.• Estimate how much space you will need to store your Splunk data.• Plan your Splunk deployment, from gigabytes to terabytes per day.• Learn how to search, monitor, report, and more•

70

One of Splunk's biggest differences from traditional technologies is that itclassifies and interprets data at search-time. Learn what this meansand how to use it.

•

If you downloaded Splunk packaged with an app (for example, Splunk +WebSphere), go to Splunk Web and select the app in Launcher to go directly tothe app?s setup page. To see more information about the setup and deploymentfor a packaged app, search for the app name on Splunkbase.

Learn about Splunk's accessibility

Splunk is dedicated to maintaining and enhancing its accessibility and usabilityfor users of assistive technology (AT), both in accordance with Section 508 of theUnited States Rehabilitation Act of 1973, and in terms of best usability practices.This topic discusses how Splunk addresses accessibility within the product forusers of AT.

Accessibility of Splunk Web and the CLI

The Splunk command line interface (CLI) is fully accessible, and includes asuperset of the functions available in Splunk Web. The CLI is designed forusability for all users, regardless of accessibility needs, and Splunk thereforerecommends the CLI for users of AT (specifically users with low or no vision, ormobility restrictions).

Splunk also understands that use of a GUI is occasionally preferred, even fornon-sighted users. As a result, Splunk Web is designed with the followingaccessibility features:

Form fields and dialog boxes have on-screen indication of focus, assupported by the Web browser.

•

No additional on-screen focus is implemented for links, buttons or otherelements that do not have browser-implemented visual focus.

•

Form fields are consistently and appropriately labeled, and ALT textdescribes functional elements and images.

•

Splunk does not override user-defined style sheets.• Data visualizations in Splunk Web have underlying data available viamouse-over or output as a data table, such that information conveyed withcolor is available without color.

•

Most data tables implemented with HTML use headers and markup toidentify data as needed.

•

71

Data tables presented using Flash visually display headers. Underlyingdata output in comma separated value (CSV) format have appropriateheaders to identify data.

•

Accessibility and real-time search

Splunk Web does not include any blinking or flashing components. However,using real-time search causes the page to update. Real-time search is easilydisabled, either at the deployment or user/role level. For greatest ease andusability, Splunk recommends the use of the CLI with real-time functionalitydisabled for users of AT (specifically screen readers). Refer to "How to restrictusage of real-time search" in the Search Manual for details on disabling real-timesearch.

Keyboard navigation using Firefox and Mac OS X

To enable Tab key navigation in Firefox on Mac OS X, use system preferencesinstead of browser preferences. To enable keyboard navigation:

1. In the menu bar, click [Apple icon]>System Preferences>Keyboard to openthe Keyboard preferences dialog.

2. In the Keyboard preferences dialog, click the Keyboard Shortcuts button atthe top.

3. Near the bottom of the dialog, where it says Full Keyboard Access, click theAll controls radio button.

4. Close the Keyboard preferences dialog.

5. If Firefox is already running, exit and restart the browser.

72

Install a Splunk license

About Splunk licenses

Splunk takes in data from sources you designate and processes it so that youcan analyze it in Splunk. We call this process indexing. For information aboutthe indexing process, refer to "What Splunk does with your data" in the GettingData In Manual.

Splunk licenses specify how much data you can index per day.

For more information about Splunk licenses, begin by reading:

"How Splunk licensing works" in the Admin Manual.• "Types of Splunk licenses" in the Admin Manual.• "More about Splunk Free" in the Admin Manual.•

Install a license

This topic discusses installing new licenses. Before you proceed, you may wantto review these topics:

Read "How Splunk licensing works" in the Admin Manual for anintroduction to Splunk licensing.

•

Read "Groups, stacks, pools, and other terminology" in the Admin Manualfor more information about Splunk license terms.

•

Add a new license

To add a new license:

1. Navigate to Manager > Licensing.

2. Click Add license.

73

3. Either click Choose file and navigate to your license file and select it, or clickcopy & paste the license XML directly... and paste the text of your license fileinto the provided field.

4. Click Install. If this is the first Enterprise license that you are installing, youmust restart Splunk. Your license is installed.

License violations

Violations occur when you exceed the maximum indexing volume allowed foryour license. If you exceed your licensed daily volume on any one calendar day,you will get a violation warning. The message persists for 14 days. If you have 5or more warnings on an Enterprise license or 3 warnings on a Free licensein a rolling 30-day period, you are in violation of your license and searchwill be disabled. Search capabilities return when you have fewer than 5(Enterprise) or 3 (Free) warnings in the previous 30 days, or when you apply atemporary reset license (available for Enterprise only). To obtain a reset license,contact your sales rep. The license comes with instructions on how to apply it.

Note: Summary indexing volume is not counted against your license.

If you get a violation warning, you have until midnight (going by the time on thelicense master) to resolve it before it counts against the total number of warningswithin the rolling 30-day period.

During a license violation period:

Splunk does not stop indexing your data. Splunk only blocks search whileyou exceed your license.

•

Searches to the _internal index are not disabled. This means that youcan still access the Indexing Status dashboard or run searches against_internal to diagnose the licensing problem.

•

Got license violations? Read "About license violations" in the Admin Manual or"Troubleshooting indexed data volume" from the Splunk Community Wiki.

74

More licensing information is available in the "Manage Splunk licenses" chapterin the Admin Manual.

75

Upgrade Splunk from an earlier version

How to upgrade Splunk

This topic discusses how to upgrade Splunk and its components from oneversion to another.

In many cases, you upgrade Splunk by installing the latest package over yourexisting installation. On Windows systems, the installer package detects whenyou have a version installed and offers to upgrade it for you.

Note: When upgrading Splunk, be sure to upgrade it using an administrativelevel account.

What's new and awesome in 5.0?

Read "Meet Splunk 5.0" in the Release Notes for a full list of the new featureswe've delivered in 5.0.

Review the known issues in the Release Notes for a list of issues andworkarounds in this release.

Always back up your existing deployment first

Get into the habit of backing up your existing deployment before any upgrade ormigration.

You can manage your risk by using technology that allows you to restore yourSplunk install and data to a state prior to the upgrade, whether you use externalbackups, disk or file system snapshots, or other means. When backing up yourSplunk data, consider the $SPLUNK_HOME directory, as well as any indexesoutside of it.

For more information about backing up your Splunk deployment, read the topics"Back up configuration information" in the Admin Manual and "Back up indexeddata" in the Managing Indexers and Clusters Manual.

76

Then, read about important migration information beforeupgrading

Important: Before upgrading, be sure to read "About upgrading to 5.0: READTHIS FIRST" for specific migration tips and information that might affect you.

Upgrade from 4.2 and later

Splunk supports a direct upgrade from versions 4.2 and later to version 5.0.

If you're upgrading from 4.3.x or later, read the rest of this topic first beforeproceeding with the installation instructions linked below.

If you're upgrading from 4.2.x to 5.0, Splunk recommends that you also reviewthe 4.3.x version of the topic you're reading now as well as this version beforeproceeding with the installation instructions:

Upgrade to 5.0 on Linux, Solaris, FreeBSD, HP-UX, AIX, and MacOS• Upgrade to 5.0 on Windows•

Upgrade from 4.1 and earlier

Upgrading directly to 5.0 from versions older than 4.2 is not officially supported. Ifyou are running a version of Splunk earlier than 4.2, then you should upgrade to4.2 first before attempting an upgrade to 5.0.

Upgrade distributed deployments

If you're planning to upgrade your distributed Splunk environment, be sure toread "Upgrade your distributed environment" in the Distributed DeploymentManual for guidance on how to do so with minimal impact.

Upgrade universal forwarders

Upgrading universal forwarders is a different process than upgrading full Splunk.Before upgrading your universal forwarders, be sure to read the appropriateupgrade topic for your operating system:

Upgrade the Windows universal forwarder• Upgrade the Unix universal forwarder•

77

To learn about interoperability and compatibility between indexers and universalforwarders, read "Indexer and universal forwarder compatibility" in the"Deployment Overview" topic of the Distributed Deployment Manual.

About upgrading to 5.0 READ THIS FIRST

This topic contains some important information and tips that you should readabout when migrating to version 5.0 from an earlier version.

You want to know this stuff

Upgrading to 5.0 from 4.2 and later is pretty simple, but here are a few tips:

We have removed the deployment monitor from the Splunk installationpackage

The deployment monitor is no longer a part of the Splunk installation package.Starting with version 5.0, the deployment monitor is now available as adownloadable app from Splunkbase.

If you use the deployment monitor, you should not be impacted by this changewhen you upgrade. However, be sure to double check your configuration toensure that the app works as desired after the upgrade is complete.

We have removed multicast distributed search peer discovery

We've removed multicast distributed search peer discovery. Starting with version5.0, you must now configure distributed search peers explicitly with SSL security.The following attributes in distsearch.conf are no longer valid:

heartbeatFrequency• blacklistNames• blacklistURLs• heartbeatMcastAddr• heartbeatPort• ttl• autoAddServers• skipOurselves•

We have deprecated the fschange monitor

We have deprecated the fschange monitor input. While it continues to function inVersion 5.0 of Splunk, it might be removed in a future version.

78

We have deprecated several REST endpoints and Python SDK classes

For version 5.0 of Splunk, we have deprecated some representational statetransfer (REST) endpoints, as well as some Python SDK classes. While theycontinue to work in this release, they might be removed entirely in a futurerelease. Read "Deprecated features" in the Release Notes for specifics.

The Windows performance monitoring input is now modular

The performance monitoring inputs for Windows now use the new modular inputtype. When you upgrade, Splunk replaces the existing scripted input with the newmodular input. During the migration, Splunk saves the existing perfmon.conf fileand renames it to perfmon.conf.migrated. It then copies the inputs defined inthat file and places them into inputs.conf under similarly-named stanzas.

This has major impact for users who use the Splunk App for MicrosoftExchange and the Splunk App for Active Directory. Those apps useperformance monitoring inputs extensively. If you use either of these apps, wesuggest that you do not upgrade the apps until compatible versions are released.

For additional information on what a modular input is, read "Modular inputsoverview" in the Developing Views and Apps for Splunk Web Manual.

Active Directory monitoring time formats have changed

The time stamp format that Splunk's Active Directory monitoring input logs in haschanged. In Splunk 5.0 and later, AD monitoring inputs log events as follows:

pwdLastSet=07:03.12 pm, Mon 04/30/2012

If you use Active Directory monitoring inputs, you might be impacted by thischange after you upgrade, particularly if you have configured alerts that rely onthe old time stamp format.

Viewstates do not persist during the upgrade

If you make a change to a view state (such as adjusting the number of items toshow per page in the flash timeline) and then upgrade Splunk, Splunk does notpreserve the view state through the upgrade, and the default view loads whenyou use the upgraded version.

This is because Splunk assigns each view state a module ID, which changeswhen you modify the view state's XML (by modifying the view).

79

Forwarding method now defaults to auto-loadbalancing

Splunk 5.0 now makes auto-load balancing the default method of forwarding datato multiple indexers at one time.

When you upgrade, any forwarding configurations (outputs.conf) which do notexplicitly have the autoLB attribute set to false will operate under the newmethod. If you do not desire this, you must explicitly add autoLB=false to theappropriate stanza(s) in outputs.conf.

Splunk now offers integrated PDF printing

With version 5.0 of Splunk comes integrated PDF printing. This means that PDFprinting no longer requires a Linux Splunk instance.

There are some things to pay attention to when upgrading, however - particularlywith regards to views that contain Advanced XML. Additional information is foundin "Upgrade PDF printing for Splunk Web" in this manual.

Splunk uses more Unix file descriptors

Splunk 5.0 uses more file descriptors on Unix filesystems than version 4.3 didwhen monitoring files.

Before you upgrade, consider increasing the number of open file descriptors yoursystem can use with the ulimit command.

Splunk's database-checking utility might use more resources

After you upgrade to 5.0, Splunk's database consistency checking utility (fsck)might use more system resources (in particular, disk I/O) when they run,particularly if bloom filters are being created at the same time.

The configuration location for globally unique identifiers (GUIDs) haschanged

We've changed the location for the configuration of GUIDs for Splunk instances.In Splunk 5.0, instead of setting the GUID in server.conf, you must now set it ininstance.cfg.

80

Upgrade to 5.0 on UNIX

This topic describes the procedure for upgrading your Splunk instance fromversion 4.0.x or later to 5.0.

Before you upgrade

Make sure you've read this information before proceeding, as well as thefollowing:

Back your files up

Before you perform the upgrade, we strongly recommend that you back up all ofyour files, including Splunk configurations, indexed data, and binaries. Splunkdoes not provide a means of downgrading to previous versions; if you need torevert to an older Splunk release, just reinstall it.

For information on backing up data, read "Back up indexed data" in theManaging Indexers and Clusters Manual.

For information on backing up configurations, read "Back up configurationinformation" in the Admin manual.

How upgrading works

After performing the installation of the new version, Splunk does not actuallymake changes to your configuration until after you restart it. You can run themigration preview utility at that time to see what will be changed before the filesare updated. If you choose to view the changes before proceeding, a filecontaining the changes that the upgrade script proposes to make is written to$SPLUNK_HOME/var/log/splunk/migration.log.<timestamp>

Steps for upgrading

1. Execute the $SPLUNK_HOME/bin/splunk stop command.

Important: Make sure no other processes will start Splunk automatically (suchas Solaris SMF).

2. To upgrade and migrate from version 4.x and later, install the Splunk packageover your existing Splunk deployment:

81

If you are using a .tar file, expand it into the same directory with the sameownership as your existing Splunk instance. This overwrites and replacesmatching files but does not remove unique files.

Note: AIX tar will fail to correctly overwrite files when run as a userother than root. Use GNU tar (gtar) to avoid this problem.

•

If you are using a package manager, such as RPM, type rpm -U[--prefix <existing Splunk location>] splunk_package_name.rpm

•

If you are using a .dmg file (on Mac OS X), double-click it and follow theinstructions. Be sure specify the same installation directory as yourexisting installation.

•

3. Execute the $SPLUNK_HOME/bin/splunk start command.

The following output is displayed:

This appears to be an upgrade of Splunk.--------------------------------------------------------------------------------Splunk has detected an older version of Splunk installed on thismachine. Tofinish upgrading to the new version, Splunk's installer willautomaticallyupdate and alter your current configuration files. Deprecatedconfigurationfiles will be renamed with a .deprecated extension.You can choose to preview the changes that will be made to yourconfigurationfiles before proceeding with the migration and upgrade:If you want to migrate and upgrade without previewing the changes thatwill bemade to your existing configuration files, choose 'y'.If you want to see what changes will be made before you proceed withtheupgrade, choose 'n'.Perform migration and upgrade without previewing configuration changes?[y/n]

4. Choose whether you want to run the migration preview script to see whatchanges will be made to your existing configuration files, or proceed with themigration and upgrade right away.

5. If you choose to view the expected changes, the script provides a list.

6. Once you've reviewed these changes and are ready to proceed with migrationand upgrade, run $SPLUNK_HOME/bin/splunk start again.

Note: You can complete Steps 3 to 5 in one line:

82

To accept the license and view the expected changes (answer 'n') beforecontinuing the upgrade:

$SPLUNK_HOME/bin/splunk start --accept-license --answer-no

To accept the license and begin the upgrade without viewing the changes(answer 'y'):

$SPLUNK_HOME/bin/splunk start --accept-license --answer-yes

Upgrade to 5.0 on Windows

This topic describes the procedure for upgrading your Windows Splunk instancefrom version 4.0.x or later to 5.0. You can upgrade using the GUI installer, or byrunning the msiexec utility on the command line as described in "Install onWindows via the command line".

Before you upgrade

Make sure you've read this information before proceeding, as well as thefollowing:

Make sure you specify the same domain user

When upgrading, you must explicitly specify the same domain user that youspecified during first time install. If you do not specify the same user, Splunk willdefault to using the Local System User. If you accidentally specify the wrong userduring your installation, use these instructions to switch to the correct userbefore starting Splunk.

Don't change the ports

Splunk does not support changing the management port and/or the HTTP portwhen upgrading.

Back your files up

Before you perform the upgrade, we strongly recommend that you back up all ofyour files, including Splunk configurations, indexed data and binaries. Splunkdoes not provide a means of downgrading to previous versions; if you need to

83

revert to an older Splunk release, just reinstall it.

For information on backing up data, read "Back up indexed data" in theManaging Indexers and Clusters Manual.

For information on backing up configurations, read "Back up configurationinformation" in the Admin manual.

Note: When you upgrade to Splunk 5.0 on Windows, the installer overwrites anycustom certificate authority (CA) certificates you have created in%SPLUNK_HOME%\etc\auth. If you have custom CA files, make sure to back themup before you upgrade. After the upgrade, you can copy them back into%SPLUNK_HOME%\etc\auth to restore them. After you have restored the certificates,restart Splunk.

Upgrade using the GUI installer

1. Stop Splunk by either using the Services control panel or executing the%SPLUNK_HOME%\bin\splunk stop command.

2. Download the new MSI file from the Splunk download page.

3. Double-click the MSI file. The Welcome panel is displayed. Follow theon-screen instructions to upgrade Splunk. For information about each panel,refer to the installation instructions.

4. Splunk will start up by default when you complete the installation.

A log of the changes made to your configuration files during the upgrade isplaced in %TEMP%.

Upgrade using the command line

1. Stop Splunk either by using the Services control panel or executing the %SPLUNK_HOME%\bin\splunk stop command.

2. Download the new MSI file from the Splunk download page.

3. Use the instructions in "Install on Windows via the command line".

If Splunk is running as a user other than the Local System user, you mustexplicitly specify this user in your command-line instruction.

•

84

You can use the LAUNCHSPLUNK flag to specify whether Splunk should startup automatically or not when you're finished, but you cannot change anyother settings.

•

DO NOT change the ports (SPLUNKD_PORT and WEB_PORT) at this time.•

4. Depending on your specification, Splunk may start automatically when youcomplete the installation.

A log of the changes made to your configuration files during the upgrade isplaced in %TEMP%.

Start Splunk

On Windows, Splunk is installed by default into %SYSTEMDRIVE%\ProgramFiles\Splunk and is started by default.

You can start and stop the following Splunk processes via the Windows Servicescontrol panel:

Server process: splunkd• Web interface process: splunkweb•

You can also start, stop, and restart both processes at once by going to%SYSTEMDRIVE%\Program Files\Splunk\bin and typing

# splunk [start|stop|restart]

Upgrade PDF printing for Splunk Web

Starting with Splunk 5.0, you can create PDFs of your dashboards, views,searches, or reports without using a Linux server.

What does this mean?

PDF functionality in Splunk Web no longer requires you to install the (nowdeprecated) PDF Report Server App. In addition, non-UI PDF reportingfunctionality uses this new integrated PDF generation.

There are exceptions involving forms, dashboards that are built with advancedXML, and simple XML dashboards that have panels that are rendered in Flashrather than JavaScript. See the "Exceptions" section, below, for more

85

information.

Use integrated PDF generation

You can:

Generate PDFs of dashboards with a click of a button.• Arrange to have PDFs of searches, reports, and dashboards sent to a setof recipients that you define, on a regular schedule.

•

Arrange to have PDFs of searches and reports sent to a set of recipientsthat you define when specific alert conditions are met.

•

Generate dashboard PDFs

When you are viewing a dashboard in Splunk, click Generate PDF to generate aPDF that you can view through your browser or a PDF viewer application. Formore information about this feature, see "Generate dashboard PDFs" in the DataVisualizations Manual.

If you use a browser that does not display graphics in the PDF format (such asIE8) you should install a PDF viewer application (if your OS does not alreadyprovide one) to enable viewing of the PDFs that Splunk generates.

Send PDFs on a regular schedule via email

You can send PDFs of reports and dashboards to interested parties on a regularschedule via email. The schedule can be any interval you require: Every hour,every day at midnight, weekly each Sunday at noon, and so on.

To send a PDF of a report to one or more recipients on a regular schedule viaemail, you'll use the Create Scheduled Search dialog when you create a searchthat returns useful results and and have formatted it to appear in a pleasingmanner. Just click Create and select Scheduled search... For more information,see "Create a scheduled search" in the Alerting Manual.

To send a PDF of a dashboard to one or more recipients on a regular schedulevia email, navigate to the dashboard and click Schedule PDF Delivery to openthe Schedule PDF Delivery dialog. For more information see "Generatedashboard PDFs" in the Data Visualizations Manual.

Splunk also enables you to set up one-time email delivery of PDF-renderedsearch results with the sendemail search command. When you include thiscommand in a search, you can arrange to have the search results sent in PDF

86

format when you run the search. For details see the sendemail topic in theSearch Reference. (Note that the sendemail command does not enable you toset up scheduled emails--it just sends an email of the search results wheneveryou run the search.)

Send PDFs with alert emails

You can design alerts that, when triggered, send emails with PDF attachmentsthat show the results of the triggering search. For more information about thedifferent kinds of alerts that you can design, read "About alerts" in the AlertingManual.

Exceptions: Advanced XML, Forms, and Flash

Integrated PDF generation cannot:

Generate PDFs from dashboards that are built with advanced XML.• Generate PDFs from forms.• Make use of chart customization parameters that are only available forFlash (rather than JavaScript) in PDFs.

•

Dashboards and forms that use advanced XML won't be printed

If you want to continue printing a pre-5.0 dashboard that uses advanced XML,and you have installed the old PDF Report Server App, you have the followingoptions:

Change nothing. Splunk will continue to use your PDF Report ServerApp to generate a PDF of the dashboard.

•

Create a simple XML version of the dashboard, using charting libraryproperties that are supported by the JSChart charting library, whichrenders chart graphics with JavaScript rather than Flash.

•

There are advanced dashboard features (such as search postprocessing) thatcan currently only be achieved with usage of advanced XML. Take note,however, that in Splunk 5.0, two dashboard features that were previously onlyavailable with advanced XML--dynamic drilldown and form searchprepopulation--have been made available in simple XML. For more informationabout these features, refer to"Dynamic drilldown in dashboards and forms" and"Build and edit forms with simple XML" in the Data Visualizations Manual.

87

Forms won't be printed

Integrated PDF generation cannot print forms at this point, whether they havebeen constructed with simple or advanced XML. You can still print forms with thePDF Report Server App, if you have it installed.

Flash-only chart customizations will be ignored

As we detail in the "About JSChart" topic of the Data Visualizations manual,Splunk uses the JSChart charting library to render dashboard panels for viewingthrough your browser except in cases where chart customizations that aren'tsupported by JSChart are implemented in the underlying simple XML. Panels thathave JSChart-unsupported customizations are instead rendered for browserdisplay by the Flash charting library.

Note: If you are using an iOS mobile device to view Splunk dashboards, youshould know that Splunk never switches to FlashChart whenJSChart-unsupported customizations are present for a chart. Instead it justrenders the chart with JSChart, ignoring the unsupported parameters.

Integrated PDF generation relies solely on the JSChart charting library to renderimages of dashboard panels in PDFs. Because of this, when Splunk usesintegrated PDF generation to generate a PDF of a dashboard it renders alldashboard panels with JSChart. When dashboard panels include simple XMLchart customizations that are unsupported by JSChart, those customizations aresimply ignored.

This means that panels with JSChart-unsupported customizations may appeardifferent in PDF format than they do in your browser. In the browser they arerendered with Flash and have the customizations, while in the PDF they arerendered with JSChart and do not include the customizations.

To see which charting library parameters are supported by JSChart, go to thecustom charting configuration reference in the Data Visualizations manual. Eachtopic in the reference contains tables of chart customization parameters, andeach table has a Supported by JSChart? column.

Note: Over time we will be increasing the number of chart customizationparameters that are compatible with JSChart, which means that you'll be able tomake a wider range of customizations to your dashboard panels and still havethem print correctly through integrated PDF generation.

88

Real-time searches and integrated PDF generation

Integrated PDF generation handles the the generation of PDFs for real-timesearches differently than the PDF Report Server App does.

When you use integrated PDF generation to generate a PDF for a search, report,or dashboard panel that runs in real time, Splunk converts the search to ahistorical search (essentially removing the "rt" from the time range). So if youhave a real-time search with a 5 minute window, the PDF will display the result ofthis search as if it had only been run over the past 5 minutes relative to themoment the PDF was generated.

If your dashboard has panels that display results for searches with "real-time alltime" time ranges, the PDF of that dashboard will display results for the samesearches over all time.

Enable usage of non-latin fonts in PDFs

Splunk comes prepackaged with a collection of Latin fonts, and also a set of CIDfonts for handling Japanese, Korean, Simplified Chinese, and TraditionalChinese.

You can control how the CID fonts are loaded by making changes to thereportCIDFontList parameter in alert_actions.conf. If multiple fonts provide aglyph for a given character code, the glyph from the first font specified in the listwill be used. By default, reportCIDFontList = gb cns jp kor, which referenceSimplified Chinese, Traditional Chinese, Japanese, and Korean respectively.

If multiple fonts provide a glyph for a given character code the glyph from the firstfont specified in the list will be used. To skip loading any CID fonts, leave thevalue of reportCIDFontList blank.

If you want your PDFs to make use of another truetype, non-Latin font (such asCyrillic or Greek) have your Splunk admin add the Unicode font to$SPLUNK_HOME/share/splunk/fonts. Create the fonts directory if it doesn'talready exist.

Note: When multiple fonts are installed, Splunk will sort through them inalphabetical order. This means that if you have Cyrillic and Greek installed it willalways choose Cyrillic unless you change the name of the files in$SPLUNK_HOME/share/splunk/fonts so Greek comes first.

89

Additional configuration for integrated PDF generation

You can configure certain aspects of integrated PDF generation in limits.confand alert_actions.conf.

limits.conf

In the [pdf] stanza you can set the max_rows_per_table to set the maximumnumber of table rows that Splunk will print out for simple results tables in a PDF.The default is 1000.

Note: This can lead to multi-page reports if your tables have lots and lots ofrows. Reduce this number if you want to limit the number of pages that a tablecan generate for a PDF version of a dashboard.

In the same stanza you can change the render_endpoint_timeout to a numberother than the default 3600 seconds (1 hour). This controls the amount of timethat Splunk will wait to generate a PDF of a slow-completing search.

alert_actions.conf

The reportIncludeSplunkLogo parameter for alert_actions.conf controlswhether the Splunk logo appears in the PDF footers. It is set to 1 (true) bydefault. If you don't want to see the Splunk logo in your PDFs, set the value to 0(false).

What to do if you have already installed the PDF ReportServer App

Not much, really.

If you are printing a set of search results or a formatted report (that displays atable or visualization), Splunk will print it with integrated PDF generation. Splunkwill also use integrated PDF generation to print dashboards that have beenconstructed in simple XML, omitting images of panels that are rendered in Flash.

You still need to configure settings in Manager > System settings > Email alertsettings if you want to schedule delivery of PDFs by email or use the sendemailcommand.

Splunk will continue to print views (forms and dashboards) that are constructed inadvanced XML with the PDF Report Server App.

90

What to do if you have not installed the PDF Report ServerApp

You don't need to install the PDF Report Server App unless you want to printforms and dashboards that either are constructed with advanced XML or whichinclude panels rendered with Flash. See the "Exceptions" subtopic, above, formore information.

System requirements

Supported operating systems:

Solaris (x86 only, not SPARC)• Linux Kernel vers. 2.6.x and above• FreeBSD 6.1 and 6.2 (x86: 64-bit)• Windows Server 2003/2003 R2 (64-bit), 2008/2008 R2 (64-bit)• Windows Vista (64-bit), XP, 7 (64-bit)• Mac OS X 10.5 and 10.6 on Intel Macs•

Integrated PDF Generation is supported on any browser that Splunk is alsosupported on. However, if you're using Internet Explorer, you will encounter fewerrendering issues if you also install Adobe Acrobat.

I still need help with the PDF Report Server App

If you have previously installed the PDF Report Server App and are experiencingproblems, refer to the topic on common symptoms with the PDF Report ServerApp in the Troubleshooting Manual.

91

Uninstall Splunk

Uninstall Splunk

This topic discusses how to remove Splunk from your system.

Before you uninstall, stop Splunk. Navigate to $SPLUNK_HOME/bin and type./splunk stop (or just splunk stop on Windows).

Uninstall Splunk with your package management utilities

Use your local package management commands to uninstall Splunk. In mostcases, files that were not originally installed by the package will be retained.These files include your configuration and index files which are under yourinstallation directory.

Note: $SPLUNK_HOME refers to the Splunk installation directory. On Windows, thisis C:\Program Files\Splunk by default. For most Unix platforms, the defaultinstallation directory is /opt/splunk; for Mac OS, it is /Applications/splunk.

RedHat Linux

To uninstall Splunk on RedHat:

rpm -e splunk_product_name

Debian Linux

To uninstall Splunk on Debian:

dpkg -r splunk

To purge (delete everything, including configuration files) on Debian:

dpkg -P splunk

92

FreeBSD

To uninstall Splunk from the default location on FreeBSD:

pkg_delete splunk

To uninstall Splunk from a different location on FreeBSD:

pkg_delete -p /usr/splunk splunk

Solaris

To uninstall Splunk on Solaris:

pkgrm splunk

HP-UX

To uninstall Splunk on HP-UX, you must stop Splunk, disable boot-start (if youconfigured it), and then delete the Splunk installation.

Note: The $SPLUNK_HOME variable refers to the directory where you installedSplunk.

1. Stop Splunk:

$SPLUNK_HOME/bin/splunk stop

2. If you enabled boot-start, run the following command as root:

$SPLUNK_HOME/bin/splunk disable boot-start

3. Delete the Splunk installation directories:

rm -rf $SPLUNK_HOME

Other things you may want to delete:

If you created any indexes and did not use the Splunk default path, youmust delete those directories as well.

•

93

If you created a user or group for running Splunk, you should also deletethem.

•

Windows

To uninstall Splunk on Windows:

Use the Add or Remove Programs option in the Control Panel. In Windows 7and Windows Server 2008, that option is available under Programs andFeatures.

You can also uninstall Splunk from the command line by using the msiexecexecutable against the Splunk installer package:

C:\> msiexec /x splunk-<version>-x64.msi

Note: Under some circumstances, the Microsoft installer might present a rebootprompt during the uninstall process. You can safely ignore this request withoutrebooting.

Uninstall Splunk manually

If you can't use package management commands, use these instructions touninstall Splunk.

Note: These instructions will not remove any init scripts that have beencreated.

1. Stop Splunk.

$SPLUNK_HOME/bin/splunk stop

2. Find and kill any lingering processes that contain "splunk" in its name.

For Linux and Solaris:

kill -9 `ps -ef | grep splunk | grep -v grep | awk '{print $2;}'`

For FreeBSD and Mac OS

94

kill -9 `ps ax | grep splunk | grep -v grep | awk '{print $1;}'`

3. Remove the Splunk installation directory, $SPLUNK_HOME. For example:

rm -rf /opt/splunk

Note: For Mac OS, you can also remove the installation directory by dragging thefolder into the trash.

3. Remove any Splunk datastore or indexes outside the top-level directory, if theyexist.

rm -rf /opt/splunkdata

4. Delete the splunk user and group, if they exist.

For Linux, Solaris, and FreeBSD:

userdel splunkgroupdel splunk

For Mac OS: You can use the System Preferences > Accounts panel tomanage users and groups.

For Windows: Open a command prompt and run the command msiexec /xagainst the msi package that you installed.

95

Reference

File and directory structure

This topic describes a Splunk installation's file and directory structure in detail.

$SPLUNK_HOME

File / directory Description

bin Splunk binary directory.

etcSplunk configuration directory.All configuration information isstored here.

include Python configuration directory.

lib Splunk runtime libraries.

license-eula.txt The Splunk software licenseagreement.

opensslSplunk's self-signed certificateauthority generator andconfiguration files.

README-splunk.txt Splunk README with links toSplunk's documentation.

share (Editor's Note: Need more info)

splunk-<versionnumber>-<build-number>-<os>-<architecture>-manifest

A list of all the files in the Splunkinstallation.

varSplunk's runtime process,database, log and spooldirectories.

$SPLUNK_HOME/bin

File / directory Descriptionbloom

btool

btprobe

bzip2

cherryd

96

classify

coldToFrozenExample.py

dbmanipulator.py

exporttool

fill_summary_index.py

genAuditKeys.py

genRootCA.sh

genSignedServerCert.py

genSignedServerCert.sh

genWebCert.py

genWebCert.sh

gzdumper

importtool

installit.py

jsmin

locktest Splunk runs this tool when run on unsupported filesystems.

locktool

node

node-waf

openssl

parsetest

pcregextest

python Symbolic link to python2.7

python2 Symbolic link to python2.7

python2.7

recover-metadata

rest_handler.py

runScript.py

scriptsscrubber.py

searchtest

setSplunkEnv

signtool

splunk Splunk's control binary and Command Line Interface (CLI)

97

splunkd The Splunk daemon

splunkmon

splunk-optimize

splunk-optimize-lex

tarit.py

tocsv.py

tsidxprobe

tsidxprobe_plo

tsidx_scan.py

untarit.py

walklex

$SPLUNK_HOME/etc

File / directory Description

anonymizer

apps' Splunk apps are usually stored here.

auth Splunk's

PGP Public Key

Following is the Pretty Good Privacy (PGP) public key for Splunk.

-----BEGIN PGP PUBLIC KEY BLOCK-----Version: GnuPG v1.4.1 (GNU/Linux)

mQGiBEbE21QRBADEMonUxCV2kQ2oxsJTjYXrYCWCtH5/OnmhK5lT2TQaE9QUTs+wnM3sVInQqwRwBDH2qsHgqjJS0PIE867n+lVuk0gSVzS5SOlYzQjnSrisvyN452MF2PgetHq8Lb884cPJnxR6xoFTHqOQueKEOXCovz1eVrjrjfpnmWKa/+5X8wCg/CJ7pT7OXHFN4XOseVQabetEbWcEAIUaazF2i2x9QDJ+6twTAlX2oqAquqtBzJX5qaHnOyRdBEU2g4ndiE3QAKybuq5f0UM7GXqdllihVUBatqafySfjlTBaMVzd4ttrDRpqWya4ppPMIWcnFG2CXf4+HuyTPgj2cry2oMBm2LMfGhxcqM5mpoyHqUiCn7591Ra/J2/FA/0c2UAUh/eSiOn89I6FhFOicT5RPtRpxMoEM1Di15zJ7EXY+xBVF9rutqhR5OI9kdHibYTwf4qjOOPOA7237N1by9GiXY/8s+rDWmSNKZB+xAaLyl7cDhYMv7CPqFTutvE8BxTsF0MgRuzIHfJQE2quuxKJFs9lkSFGuZhvRuwRcrQgS2ltIFdhbGxhY2UgPHJlbGVhc2VAc3BsdW5rLmNvbT6IXgQTEQIAHgUCRsTbVAIbAwYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRApYLH9ZT+xEhsPAKDimP8sdCr2ecPm8mre/8TK3BhapQCg3/xEickiRKKlpKnySUNLR/ZBh3m5Ag0ERsTbbRAIAIdfWiOBeCj8BqrcTXxm6MMvdEkjdJCr4xmwaQpYmS4JKK/hJFfpyS8XUgHjBz/7zfR8Ipr2CU59Fy4vb5oUHeOecK9ag5JFdG2i/VWH/vEJAMCkbN/6aWwhHt992PUZC7EHQ5ufRdxGGap8SPZTiIKY0OrX6Km6usoVWMTYKNm/v7my8dJ2F46YJ7wIBF7arG/voMOg1Cbn7pCwCAtg

98

jOhgjdPXRJUEzZP3AfLIc3t5iq5n5FYLGAOpT7OIroM5AkgbVLfj+cjKaGD5UZW7SO0akWhTbVHSCDJoZAGJrvJs5DHcEnCjVy9AJxTNMs9GOwWaixfyQ7jgMNWKHJp+EyMAAwYH/RLNK0HHVSByPWnS2t5sXedIGAgm0fTHhVUCWQxN3knDIRMdkqDTnDKdqcqYFsEljazI2kx1ZlWdUGmvU+Zb8FCH90ej8O6jdFLKJaq50/I/oY0+/+DRBZJG3oKu/CK2NH2VnK1KLzAYnd2wZQAEja4O1CBV0hgutVf/ZxzDUAr/XqPHy5+EYg964Xz0PdZiZKOhJ5g4QjhhOL3jQwcBuyFbJADw8+Tsk8RJqZvHfuwPouVU+8F2vLJKiF2HbKOUJvdH5GfFuk6o5V8nnir7xSrVj4abfP4xA6RVum3HtWoD7t//75gLcW77kXDR8pmmnddm5VXnAuk+GTPGACj98+eISQQYEQIACQUCRsTbbQIbDAAKCRApYLH9ZT+xEiVuAJ9INUCilkgXSNu9p27zxTZh1kL04QCg6YfWldq/MWPCwa1PgiHrVJngp4s==Mz6T-----END PGP PUBLIC KEY BLOCK-----

Installing the key

Copy and paste the key into a file. Install the key using:

rpm --import <filename>

99