VMware ESXi and vSphere Cluster Management

Install the Splunk Universal Forwarder on Linux

Learn how to choose, install, start, license, verify, and prepare the Splunk Universal Forwarder on Ubuntu, Debian, and other Linux systems.

The Splunk Universal Forwarder is a lightweight Splunk agent. It collects selected machine data, such as system logs, and sends that data to a Splunk receiving component, commonly an indexer. An indexer receives, processes, stores, and indexes Splunk data.

A Universal Forwarder is not a full Splunk Enterprise installation. It is intended to collect and forward data rather than provide the complete search, indexing, and administration experience. After installation, you must configure at least one forwarding destination and one or more data inputs before useful events can reach Splunk.

Choose a Linux package format

Splunk provides three common Linux distribution formats for the Universal Forwarder. Select the package that matches the operating system and the way you manage software.

A .deb file is a Debian package. An .rpm file is an RPM package. A tar archive is a compressed collection of files that can be extracted manually instead of being installed through the operating system's package manager.

Download the correct Universal Forwarder build

1. Open the official Splunk Universal Forwarder download page.
2. Select the Linux platform.
3. Choose the package format that matches the host, such as a Debian package for Ubuntu.
4. Select the correct CPU architecture. Many current servers use 64-bit x86, often shown as Linux x86_64, but verify the architecture of the actual host.
5. Download the installer and note its exact filename and local download directory.

Do not replace the actual filename with a guessed version. Package filenames include the product version, platform, and architecture. You can identify the architecture with a command such as:

uname -m

For example, a downloaded Debian package may have a name similar to splunkforwarder-<version>-Linux-x86_64.deb. The exact name depends on the release selected on the download page.

Prepare the Linux host

1. Open a terminal session on the Linux host.
2. Change to the directory containing the downloaded installer.
3. Confirm the package is present and record its exact filename.
4. Check that the intended installation path has sufficient disk capacity.
5. Ensure that your account can use sudo. Installation and service control normally require elevated privileges.

cd ~/Downloads
ls -lh
sudo -v
df -h /opt

If the package was downloaded elsewhere, replace ~/Downloads with that directory. The standard Universal Forwarder installation directory is typically /opt/splunkforwarder.

Install on Ubuntu or Debian with a .deb package

On Ubuntu and Debian-family systems, use dpkg to install the local Debian package. dpkg is the low-level Debian package management command used to install a local .deb file.

sudo dpkg -i splunkforwarder-<version>-Linux-x86_64.deb

Run this command from the directory containing the package, or provide the package's absolute path:

sudo dpkg -i /path/to/splunkforwarder-<version>-Linux-x86_64.deb

Replace the placeholder with the exact downloaded filename. Successful installation creates the forwarder software tree, normally at /opt/splunkforwarder, including its executable management script at /opt/splunkforwarder/bin/splunk.

Confirm that the installation directory exists:

ls -ld /opt/splunkforwarder
ls -l /opt/splunkforwarder/bin/splunk

Start the forwarder and accept the license

The splunk command is the command-line administration utility in the forwarder's bin directory. It supports actions such as starting, stopping, checking status, configuring, and enabling service startup.

Start the Universal Forwarder using its full path:

sudo /opt/splunkforwarder/bin/splunk start

On the first startup, Splunk displays its license agreement interactively. Read the prompt and respond affirmatively when asked whether you accept the license. Startup continues only after the license acceptance is completed.

You can also move into the binary directory first:

cd /opt/splunkforwarder/bin
sudo ./splunk start

Verify that the forwarder is running

After startup completes, check the local service status:

sudo /opt/splunkforwarder/bin/splunk status

A running status confirms that the local forwarding service has started. An installed-but-stopped forwarder has files such as /opt/splunkforwarder/bin/splunk but reports that the service is not running or has no active process.

Local process status does not prove that events are reaching Splunk. Forwarding destinations, inputs, receiver configuration, firewall rules, and network connectivity must also be validated.

Core post-installation commands

Configure a forwarding destination

A forwarder needs a receiving destination. The commonly used configuration file is outputs.conf, which defines where forwarded data is sent. You can also add a destination with the Splunk CLI:

sudo /opt/splunkforwarder/bin/splunk add forward-server <indexer-host>:9997 -auth <admin-user>:<password>

Replace the host, port, and credentials with values appropriate for your environment. Port 9997 is a common Splunk receiving port, but the receiving component may use another configured port. The indexer or other receiving Splunk component must be configured to accept forwarded data.

For managed deployments, an outputs.conf file commonly contains a target similar to this:

[tcpout]
defaultGroup = primary_indexer

[tcpout:primary_indexer]
server = indexer.example.internal:9997

Use a deployment-specific configuration path and security controls. Avoid placing reusable passwords directly in shell history or shared configuration files.

Configure inputs for Linux logs

The inputs.conf file defines the local data that the forwarder collects. Installing and starting the forwarder does not automatically make every system log an input.

A basic monitored-file input may look like this:

[monitor:///var/log/auth.log]
disabled = false
index = linux
sourcetype = linux_secure

File names differ by distribution. For example, some systems use /var/log/secure instead of /var/log/auth.log. Confirm that the files exist and that the forwarder account has permission to read them. After changing configuration, restart or reload the forwarder as required by your deployment process.

Enable startup at boot

After a successful manual start and basic validation, optionally enable boot-time startup:

sudo /opt/splunkforwarder/bin/splunk enable boot-start

Use this in production only after confirming that the service account, installation path, permissions, and operational dependencies are correct. Then reboot testing or service-manager validation can confirm that the forwarder starts automatically.

Validate end-to-end forwarding

1. Confirm that /opt/splunkforwarder exists.
2. Run the status command and confirm that the forwarder is running.
3. Confirm that at least one input is enabled in inputs.conf or through the CLI.
4. Confirm that an indexer or other receiving destination is configured in outputs.conf or through the CLI.
5. Test network reachability to the configured receiving host and port.
6. Generate or wait for a known log event.
7. Verify that the event appears in the expected Splunk index.

This final check distinguishes a running local agent from a working data pipeline.

Troubleshooting common problems

The .deb installer cannot be found

The terminal may be in a different directory, or the command may not match the downloaded version and architecture. List the current directory and use the exact filename:

pwd
ls -lh
sudo dpkg -i ./actual-downloaded-filename.deb

Installation fails because of insufficient privileges

Repeat the installation with sudo and confirm that your account is authorized to use it:

sudo dpkg -i /path/to/package.deb
sudo -v

The splunk command is not found

Use the full path to the command. This commonly happens when the shell is not in the forwarder's bin directory:

sudo /opt/splunkforwarder/bin/splunk status

If you installed a tar archive into a custom location, adjust the path to that installation. Also verify that the software was actually installed.

The forwarder does not start

Run the start command interactively and complete the initial license prompt. If startup still fails, review the status output and the forwarder's logs for permission, port, or configuration errors. A partially completed first startup can prevent normal operation until the interactive setup is completed.

The forwarder is running but no data appears in Splunk

• Check that an input is configured and enabled.
• Check that a forwarding destination is configured.
• Verify the receiving host and port.
• Check firewalls and network routes between the Linux host and receiver.
• Review forwarder-side and receiver-side logs.
• Confirm that the event is being searched in the correct index and with the expected source or sourcetype.

Summary

For an Ubuntu or Debian host, the basic workflow is to download the official 64-bit .deb package, navigate to its directory, install it with dpkg, start /opt/splunkforwarder/bin/splunk, accept the license, and verify the status. The installation is only the beginning: configure outputs.conf or a forwarding destination, define log inputs in inputs.conf, validate network reachability, and confirm received events in Splunk.

For the next configuration step, continue with Linux Universal Forwarder setup and forwarding configuration.