Install Splunk on Linux

Splunk can be installed on a Linux system in three ways:

  • using an RPM package.
  • using a DEB package.
  • using a compressed .tar file.

The correct way to install Splunk depends on your Linux distribution: whether it’s an RPM or DEB-based distribution. Here is how we would install Splunk on Ubuntu, a DEB-based distribution.

Go to https://www.splunk.com/en_us/download/splunk-enterprise.html and click the Linux button:

download_splunk_linux

Select the version you would like to download. We will select the 64-bit .deb version:

download splunk linux version

Open the shell and browse to the packet location. Note that .deb version can only be installed in the default location (/opt/splunk). To start the installation, run the sudo dpkg -i splunk_package_name.deb command (change splunk_package_name.deb to the name of the package you’ve downloaded):

install splunk linux command

After the installation is completed, you can start Splunk by typing the following command from $SPLUNK_HOME/bin directory:

linux start splunk

The first time you start Splunk after a new installation, you will need to accept the license agreement. Press y:

linux start splunk license

Splunk tutorial

Splunk tutorial

Geek University 2022