Splunk online course

Install Splunk Enterprise on Linux

Learn how to choose, download, install, and start Splunk Enterprise on Ubuntu or another Linux distribution using the correct package format.

Overview

Splunk Enterprise is the Splunk platform software installed on a Linux host for collecting, searching, and analyzing machine data. This lesson uses a 64-bit Ubuntu system as the example.

Linux installers are available in three forms: DEB packages, RPM packages, and compressed tar archives. Ubuntu is Debian-based, so this procedure uses the DEB package and the dpkg command.

Choose the Linux installer format

A Linux distribution family determines which package format is normally appropriate. Debian-family systems use DEB packages, while RPM-family systems use RPM packages.

Splunk Linux Installer Formats

DEB — Typical distribution family: Debian and Ubuntu. Installation approach: install the local package with dpkg.

RPM — Typical distribution family: RPM-based Linux distributions. Installation approach: use the appropriate RPM package tooling.

tar archive — Typical use: Linux systems where an archive-based installation is appropriate. Installation approach: unpack the archive and use the extracted Splunk directory.

A DEB is a package format used by Debian-family systems, including Ubuntu. An RPM is a package format generally used by RPM-family distributions. A tar archive is a compressed archive that provides an archive-based installation option.

Use the DEB path in this lesson for Ubuntu or another Debian-family host. Use an RPM installer on an RPM-family host. Do not select a DEB file solely because the host runs Linux; the distribution family must match the package.

Download Splunk Enterprise

  1. Open the official Splunk Enterprise download page.
  2. Select the Linux download category.
  3. Choose the Splunk Enterprise release you want to install.
  4. Select an installer that matches the host architecture. A typical 64-bit Ubuntu system uses the 64-bit DEB installer.
  5. Confirm that the downloaded filename ends in .deb.

The file extension is a useful final check. A DEB installation should use a DEB file, an RPM installation should use an RPM file, and an archive installation should use the downloaded tar archive.

Prepare the Ubuntu host

Open a terminal session using an account that has sudo privileges. Then change to the directory containing the downloaded installer.

cd /path/to/downloaded/package

Replace /path/to/downloaded/package with the actual directory. Before installing, identify the exact package filename. The name shown in the command must match the downloaded file, including its version, architecture, and .deb extension.

You can inspect the current directory with a normal directory-listing command:

ls

Install the DEB package on Ubuntu

dpkg is the Debian package-management command used to install a local DEB file. Run it with sudo so the package can be installed system-wide.

sudo dpkg -i splunk_package_name.deb

Replace splunk_package_name.deb with the exact filename downloaded from the Splunk Enterprise download page. For example, the command structure is the same whether the actual filename contains a release number, architecture label, or other package details.

For the DEB installation shown here, Splunk is installed in its default directory:

/opt/splunk

SPLUNK_HOME is the environment-style name for the directory where Splunk is installed. In this example, SPLUNK_HOME is /opt/splunk. After installation completes, Splunk command-line tools are available beneath that installation directory, especially in /opt/splunk/bin.

Start Splunk for the first time

Move into Splunk's bin directory:

cd /opt/splunk/bin

Start Splunk by invoking the local command:

./splunk start

During the first startup, Splunk displays its license agreement. This is the agreement that must be accepted before initial startup can complete. Read the prompt and enter the affirmative response requested by the installer.

After you accept the license agreement and complete any other prompts shown by the startup process, Splunk continues starting its services. Keep the terminal output available if you need to diagnose a problem.

Ubuntu installation workflow

Download — Action: choose a 64-bit DEB package. Expected result: the installer file is saved locally.

Install — Action: run dpkg with sudo. Expected result: Splunk is installed under /opt/splunk.

Start — Action: invoke the Splunk CLI from the bin directory. Expected result: the initial license acceptance prompt is displayed.

Complete example: 64-bit Ubuntu

  1. From the official Splunk Enterprise download area, select Linux and download the 64-bit DEB installer.
  2. Open a terminal with an authorized account.
  3. Change to the directory where the browser saved the installer.
  4. Install the local DEB file with sudo dpkg -i, substituting the exact downloaded filename.
  5. Change to /opt/splunk/bin.
  6. Run ./splunk start.
  7. Accept the license agreement when the first-start prompt appears.
cd /path/to/downloaded/package
sudo dpkg -i splunk_package_name.deb
cd /opt/splunk/bin
./splunk start

Troubleshoot common installation problems

The DEB file cannot be found

Likely cause: The terminal is in a different directory, or the filename in the command does not exactly match the downloaded file.

Resolution: Change to the download directory, list its contents, and copy the exact package name into the dpkg command.

cd /path/to/downloaded/package
ls
sudo dpkg -i exact_downloaded_filename.deb

The installation command is denied

Likely cause: The current user does not have administrative privileges.

Resolution: Use an authorized account and run the installation command with sudo.

The package format does not match the distribution

Likely cause: A DEB package was selected for a non-Debian distribution.

Resolution: Download the RPM package for an RPM-based system, or select the tar archive method when that approach is suitable for the environment.

The Splunk start command is not found

Likely cause: The command is being run outside Splunk's bin directory, or the installation path is incorrect.

Resolution: For the default DEB installation, run the command from /opt/splunk/bin:

cd /opt/splunk/bin
./splunk start

Splunk pauses during first startup

Likely cause: The initial license prompt has not been accepted.

Resolution: Review the displayed agreement and enter the affirmative response required by the prompt.

What to do next

After Splunk starts, the next logical task is to access the Splunk web interface and perform initial platform setup. You can then continue with tasks such as adding data to Splunk and creating an index.

Installing Splunk on Windows is a separate, platform-specific procedure. See Install Splunk on Windows for that workflow.