Install Splunk Enterprise on Linux

Learn how to choose, download, and install Splunk Enterprise on Ubuntu and other Linux distributions using DEB, RPM, or tar archive packages.

Splunk Enterprise is a platform for collecting, searching, and analyzing machine data. This lesson explains how to install it on Linux, with a focus on Ubuntu and the DEB package.

You should be comfortable opening a terminal, navigating files and directories, using sudo for administrative commands, identifying your Linux distribution, and downloading software from a vendor website.

Choose the Splunk Linux installer format

A Linux distribution is a particular variant of the Linux operating system. Its package system usually determines which installer format you should use.

Splunk Enterprise is distributed for Linux in three common forms:

  • RPM package: A package format commonly used by RPM-based Linux distributions.
  • DEB package: A package format used by Debian-based distributions such as Ubuntu.
  • Compressed tar archive: An archive that you extract manually instead of installing through a native package manager.

Distribution family: Debian-based

Typical example: Ubuntu

Recommended installer: DEB

Installation approach: Install the local package with dpkg.

Distribution family: RPM-based

Typical examples: Linux distributions that use the RPM package system

Recommended installer: RPM

Installation approach: Use the applicable RPM installation process.

Distribution family: Generic or manual deployment

Typical examples: Systems where archive installation is preferred

Recommended installer: Compressed tar archive

Installation approach: Extract the archive and configure the installation manually.

Select the correct Splunk download

  1. Open the official Splunk Enterprise download page in a browser.
  2. Choose the Linux platform option.
  3. Select the Splunk Enterprise version appropriate for your environment. In a production environment, check your organization's compatibility and support requirements before choosing a version.
  4. Select the system architecture that matches the host. For most current Ubuntu servers, this is the 64-bit download.
  5. Choose the DEB installer for Ubuntu or another Debian-based distribution.
  6. Download the installer and note the directory and exact filename used by the browser.

Do not choose an RPM merely because it is also listed as a Linux download. Match the package format to the distribution family: DEB for Debian-based systems and RPM for RPM-based systems.

Install Splunk Enterprise on Ubuntu with a DEB package

1. Open a terminal and locate the downloaded file

Open a terminal session and change to the directory containing the downloaded DEB file. The following example assumes the file is in the downloads directory:

cd ~/Downloads

Use the actual directory on your system. If you are unsure of the filename, list the directory contents:

ls

2. Install the DEB package

dpkg is the Debian package-management utility used to install a local DEB package. Run it with elevated privileges:

sudo dpkg -i splunk_package_name.deb

Replace splunk_package_name.deb with the exact filename downloaded from the Splunk Enterprise download page. For example, if the downloaded file has a version-specific name, use that complete name rather than the placeholder.

The DEB installation uses the default Splunk installation path, /opt/splunk.

Understand SPLUNK_HOME and the Splunk command directory

SPLUNK_HOME means the root directory of a Splunk installation. For the DEB installation described here:

SPLUNK_HOME=/opt/splunk

Splunk management commands are stored in the bin directory below this root:

/opt/splunk/bin

Changing to this directory makes it clear which Splunk executable you are running and allows the relative command ./splunk to be used.

Purpose: Default installation root

Path or command: /opt/splunk

Notes: This is SPLUNK_HOME for the described DEB installation.

Purpose: Splunk command directory

Path or command: /opt/splunk/bin

Notes: Run Splunk management commands here.

Purpose: Install package

Path or command: sudo dpkg -i <package-name>.deb

Notes: Replace the placeholder with the downloaded filename.

Purpose: Start Splunk

Path or command: ./splunk start

Notes: The initial launch requires license acceptance.

Start Splunk for the first time

After the package installation completes, change to the Splunk command directory:

cd /opt/splunk/bin

Start Splunk Enterprise with:

./splunk start

The first startup presents the Splunk license agreement. This is the agreement that must be accepted before a new installation can complete its initial startup. Read the prompt and respond affirmatively when asked to accept the agreement.

After the startup process finishes successfully, Splunk Enterprise is running. Accessing the Splunk web interface is the next task; it is separate from installing the DEB package and completing first-run startup.

Complete Ubuntu installation example

In this example, an administrator installs a 64-bit Splunk Enterprise DEB package on Ubuntu:

  1. On the official Splunk Enterprise download page, select Linux, choose the required version, select 64-bit architecture, and download the DEB installer.
  2. Open a terminal.
  3. Move to the directory containing the downloaded file:
cd ~/Downloads
  1. Install the package, replacing the example filename with the real downloaded filename:
sudo dpkg -i splunk_package_name.deb
  1. Move to the Splunk command directory:
cd /opt/splunk/bin
  1. Start Splunk:
./splunk start
  1. Accept the license agreement at the interactive first-start prompt.
  2. After Splunk reports a successful startup, continue with access to the Splunk web interface.

Troubleshoot common installation problems

Package format does not match the operating system

Symptom: The selected installer is not appropriate for the host.

Likely cause: An RPM package was selected for a Debian-based system, or a DEB package was selected for an RPM-based system.

Resolution: Identify the Linux distribution family and download the matching Splunk installer format. For Ubuntu, select DEB.

dpkg cannot find the DEB file

Likely cause: The terminal is not in the directory containing the downloaded file, or the filename was entered incorrectly.

Resolution: Change to the correct download directory, run ls, and copy the exact filename into the dpkg command.

The Splunk start command is not found

Likely cause: The command is being run outside the Splunk bin directory, or the installation path was assumed incorrectly.

Resolution: For the DEB installation described here, run:

cd /opt/splunk/bin
./splunk start

First startup does not finish

Likely cause: The initial license agreement has not been accepted.

Resolution: Continue through the interactive first-start prompt and respond affirmatively to the license agreement.

Key points to remember

  • Use a DEB package on Ubuntu and other Debian-based distributions.
  • Use an RPM package on RPM-based distributions.
  • A tar archive is an alternative for manual extraction and configuration.
  • The described DEB installation places Splunk at /opt/splunk.
  • The Splunk command executable is under /opt/splunk/bin.
  • The first ./splunk start requires interactive license acceptance.
  • Once Splunk starts successfully, proceed to the separate task of accessing its web interface.