Install the Splunk Universal Forwarder on Linux

Learn how to choose, download, install, start, and verify the Splunk Universal Forwarder on Ubuntu, Debian, and other Linux systems.

The Splunk Universal Forwarder is a lightweight Splunk agent installed on a source host. It collects machine data such as log files and forwards that data to Splunk infrastructure for indexing or processing.

A Universal Forwarder is not a full Splunk Enterprise deployment. It is designed to collect and send data while using fewer resources than a full Splunk instance. Install the forwarder before configuring the inputs it should monitor or the destinations to which it should forward data.

Choose a Linux package format

Splunk provides Linux Universal Forwarder packages in several formats. Choose a format that matches the distribution, processor architecture, and package-management practices used by your organization.

Package format — Typical distribution family — Installation approach — When to use it

.deb — Debian, Ubuntu, and related distributions — Install with Debian package tools such as dpkg — Use for native package installation on Ubuntu or Debian.

.rpm — Red Hat-derived and other RPM-based distributions — Install with the distribution's RPM package tools — Use when the target host is managed with RPM.

tar archive — Most Linux distributions — Extract and configure manually — Use for manual, portable, or non-native package workflows.

For this lesson, the worked example uses a 64-bit Debian package on Ubuntu or another Debian-based Linux distribution.

Download the correct Universal Forwarder package

Open the Splunk Universal Forwarder download area.
Select Linux as the platform.
Choose a forwarder release that is compatible with your Splunk environment and support requirements.
Select the architecture used by the host, such as 64-bit Linux.
Choose the Debian package for an Ubuntu or Debian host.
Download the package to the Linux host, or copy it to a directory accessible from your terminal.

The downloaded filename contains the release, architecture, and package format. Do not assume that the filename in an example is identical to your file. Use the exact name shown on your host.

Prepare the Linux host

Open a terminal session on the target host and navigate to the directory containing the downloaded installer. For example:

cd ~/Downloads
ls

Use ls to confirm the package is present. Copy the exact filename from the output. Installation and service startup require elevated privileges, so the commands below use sudo.

Install the .deb package with dpkg

dpkg is the low-level Debian package-management command used to install a local .deb file. Replace the placeholder below with the exact downloaded filename:

sudo dpkg -i splunk_package_name.deb

You can also provide the full path instead of changing to the download directory:

sudo dpkg -i ~/Downloads/splunk_package_name.deb

After a successful package installation, the forwarder files are typically placed in:

/opt/splunkforwarder

This directory contains the Universal Forwarder installation. Its bin directory contains the splunk command-line executable used to control and configure the software.

Resolve dependency errors

dpkg installs the local package but does not always resolve missing operating-system dependencies automatically. If it reports missing dependencies, use the Debian or Ubuntu package manager to resolve them, then complete or retry the installation. For example:

sudo apt-get -f install

Review the package-manager output before proceeding. Dependency messages identify packages or libraries that the host still needs.

Start the Universal Forwarder

Change to the forwarder's bin directory, which is the installation subdirectory containing the Splunk CLI:

cd /opt/splunkforwarder/bin

Start the forwarder with:

sudo ./splunk start

During the first startup, Splunk displays its license agreement. Read the prompt and respond affirmatively when asked to accept the agreement. Startup cannot complete until the license terms are accepted.

If your installation uses a different directory, change to that installation's bin directory or run the executable by its full path.

Verify the forwarder status

After startup completes, check whether the local forwarder processes are running:

sudo ./splunk status

A successful status result indicates that the Universal Forwarder started correctly on the local host. You can also verify that the expected installation directory exists:

ls -ld /opt/splunkforwarder
ls -l /opt/splunkforwarder/bin/splunk

Running status confirms local startup only. It does not prove that events are being collected or delivered to Splunk. Inputs, forwarding destinations, network access, and receiver configuration must be validated separately.

Installation workflow summary

Stage — Action — Expected outcome

Download — Select Linux, a compatible release, the host architecture, and the appropriate package format — A matching installer is available on the host.

Install package — Run sudo dpkg -i for the local Debian package — The forwarder is installed, typically under /opt/splunkforwarder.

Start forwarder — Run sudo ./splunk start from the bin directory — The first-run startup process begins.

Accept license — Respond affirmatively to the license prompt — Initial startup can complete.

Verify status — Run sudo ./splunk status — The CLI reports whether the forwarder processes are running.

Troubleshoot common installation problems

The .deb file cannot be found

The terminal may be in the wrong directory, or the filename may not exactly match the downloaded file. Run ls, compare the complete filename including its version and architecture, and use that name in the installation command. You can also provide the package's full path.

`dpkg` reports missing dependencies

Required operating-system packages or libraries may be absent. Use the distribution package manager to resolve dependencies, then retry the installation or complete the pending package configuration.

The `splunk` command is not found

The command is normally available in /opt/splunkforwarder/bin, not necessarily in the shell's default PATH. Run cd /opt/splunkforwarder/bin first, use ./splunk, or invoke the executable by its full path. If the directory does not exist, confirm that installation completed and check whether a different installation location was used.

The forwarder does not start

Repeat the start operation and complete the license prompt. Confirm that you used sufficient privileges with sudo. If startup still fails, review the status output and the forwarder's local logs for installation, permissions, configuration, or operating-system errors.

The status is running but no data appears in Splunk

A running process does not guarantee data delivery. The forwarder may have no monitored inputs, no configured forwarding destination, or no network path to the receiving Splunk service. Configure inputs and outputs, then validate connectivity and receiver settings.

Configure the forwarder after installation

Installation is only the first stage. Next, configure data inputs to identify the logs, files, directories, or other machine data that the forwarder should collect.

Configure a receiving Splunk indexer, deployment server, or another appropriate target. The receiving side and the forwarder must agree on the required connection and data settings. For centralized event collection, repeat this workflow on each Linux host that should send data to Splunk.

Continue with Configure a Splunk Forwarder on Linux and Monitor Logs Using Forwarders. You may also review Set Up a Receiver, Add Data to Splunk, and What Are Forwarders.