Install Splunk Enterprise on Windows
Learn how to install Splunk Enterprise on Windows with default or customized settings, choose a service account, configure ports, and verify Splunk Web.
Purpose and deployment scope
Splunk Enterprise is a platform for collecting, indexing, searching, analyzing, and visualizing machine data. On Windows, it can index data such as event logs, application logs, and performance information.
This lesson covers installing Splunk Enterprise on one Windows host by using the graphical Windows installer. The result is a local, standalone Splunk instance that can index and search data on that host.
A standalone installation is different from a distributed deployment. If Splunk must collect data from many remote Windows systems, receive data from forwarders, or participate in a search head, indexer, or deployment-server architecture, additional planning and components are required. See monitoring remote Windows event logs, installing a Windows forwarder, and what forwarders are.
Plan the installation
Before downloading the installer, confirm that the selected Windows host meets the supported operating-system, CPU, memory, storage, and network requirements for the Splunk Enterprise release you intend to deploy. Requirements can vary by release and workload, so verify them in the product documentation for that release.
Decide on default or customized settings
A default installation is quick and useful for a proof of concept or a local test. A customized installation is preferable when the server has a separate application volume, organizational port standards, a required service identity, or production storage and security requirements.
Choose storage
Select an installation directory with enough capacity for application files, indexes, logs, and future data growth. Do not evaluate capacity only by the size of the installer. Index storage can grow substantially as data is collected and retained.
Plan ports
The commonly used Splunk management port is 8089. Splunk Web commonly uses HTTPS port 8000. Both values are configurable, and the installer or existing configuration may use different ports. Check for conflicts with existing services and document the final assignments.
Plan the Windows service identity
The Splunk Windows service can run as the built-in Local System account or as a domain account. Local System is often sufficient when the instance collects only local data. A dedicated domain service account may be required when the intended inputs need authenticated access to domain resources or remote Windows systems.
Run the installer with an account that has local administrative privileges. Coordinate service-account decisions with the Windows and Active Directory administrators before installation.
Download Splunk Enterprise for Windows
- Open the official Splunk Enterprise download page by navigating to Splunk's product download area.
- Choose the Windows distribution.
- Select the installer architecture that matches the target operating system. Modern Windows environments typically use the 64-bit distribution.
- Sign in or create a Splunk account if the download process requires one.
- Save the Windows installer package to a controlled local directory.
- Verify that the download completed and that the file came from the official Splunk source. If the file is incomplete, blocked, or flagged by endpoint security, obtain a fresh copy through the official download process rather than using an untrusted mirror.
Launch the graphical installer
Locate the downloaded Windows installer package and start it. Approve the User Account Control prompt and provide administrative approval when Windows requests it.
The installer presents a choice between a default installation and customized options. Choose the default workflow for a quick local installation when the standard directory, ports, service identity, and shortcut behavior are acceptable. Choose customized installation when you need to control any of those settings.
Default installation behavior
With default settings, Splunk Enterprise is typically installed beneath Program Files on the system drive, commonly in a Splunk-named directory. The default management and web ports are used unless the installer or release changes them. The Windows service normally runs as Local System, and a Start Menu shortcut is normally created.
Review these choices before proceeding. A default path may place indexes and logs on a system volume with limited capacity. Default ports may conflict with an existing service, and Local System may not have the identity needed for remote or domain-based collection.
Default installation versus customized installation
| Decision area | Default installation | Customized installation | When to choose it |
|---|---|---|---|
| Installation directory | Typically under Program Files on the system drive | Choose another local volume or directory | Use customization when storage layout, capacity, or organizational standards require it |
| Web and management ports | Uses the standard configured values, commonly 8000 and 8089 | Review or change ports as required | Customize when a port conflicts or firewall policy requires different assignments |
| Windows service account | Local System | Local System or a selected domain account | Use a domain identity when authenticated access to domain or remote resources is required |
| Start Menu shortcut | Normally created | Choose whether to create it | Customize according to workstation and server administration standards |
| Deployment suitability | Fast proof-of-concept or local-only installation | Managed or production-oriented installation | Prefer customization when security, storage, identity, or network requirements are known |
Customize the installation
Select the installation directory
Choose a non-default directory when the system drive is not intended for Splunk data, when a dedicated application volume is available, or when your organization requires a standard path. Confirm that the selected volume has sufficient free space and appropriate Windows permissions.
Select the shortcut option
Choose whether the installer should create a Start Menu shortcut. The shortcut is convenient but is not required for Splunk to run.
Review the settings
Before starting the installation, confirm the destination path, web and management ports, service account, shortcut choice, and any other displayed options. Record the final values for operations documentation.
Select a Splunk service account
A service account is an identity dedicated to running an application or Windows service rather than an account used interactively by a person.
| Account type | Typical use case | Local machine access | Domain or remote-resource access considerations | Security considerations |
|---|---|---|---|---|
| Local System | Local-only collection and many standalone installations | Extensive rights on the local computer | It does not provide the same identity as a domain user when accessing network resources | Simple to deploy, but do not assume it can authenticate to remote resources as the required domain identity |
| Dedicated domain service account | Authenticated access to domain resources or remote Windows data sources | Permissions depend on local group membership and assigned user rights | Can be granted narrowly scoped access to authorized hosts, event logs, shares, performance data, or other inputs | Prefer a dedicated least-privileged identity; do not use a personal administrator account |
Least privilege means granting only the permissions required for the intended tasks. Local System is suitable for many local-only scenarios, but it has limited identity and access outside the host. A domain account can be appropriate for remote collection, but its effective permissions must match the collection method and target resources.
Domain account prerequisites
When choosing a domain account, validate the following with your Windows and Active Directory administrators:
- The account belongs to the Active Directory domain or forest that contains the resources it must access.
- The account is approved for use as a Windows service account on the Splunk host.
- The account is active, not locked or expired, and complies with organizational password and service-account policy.
- The account has the local privileges required by the installation and service design. It may need membership in the server's local Administrators group when the planned deployment or collection tasks require it; do not grant this membership automatically.
- The account has any required user-right assignments, including service logon rights where applicable.
- The account has permissions for the specific inputs it will use, such as Windows event logs, performance data, remote management, network shares, or other configured resources.
- Firewall rules, DNS resolution, routing, and target-host permissions support the intended remote access.
Use the narrowest permissions that work, test them against one authorized target, and document the approved access. Validate the final design with the teams responsible for Windows and Active Directory.
Complete the installation
- If a domain service account was selected, enter its domain, username, and password in the format requested by the installer. Do not place real credentials in documentation or screenshots.
- Confirm the destination directory, service account, shortcut option, ports, and other selections.
- Start the installation.
- Allow the installer to copy files, create the Splunk Enterprise Windows service, and apply the selected configuration.
- Record the installation path, service identity, Splunk Web port, and management port.
If the installer asks for administrative approval, approve it only through the normal Windows elevation process. If the installation fails, note the exact message before closing the installer.
Verify the installation
| Check | How to verify | Expected result | If unsuccessful |
|---|---|---|---|
| Windows service status | Open the Windows Services console and locate the Splunk Enterprise service | The service exists, uses the intended Log On account, and is running | Inspect service properties, credentials, user-right assignments, Splunk logs, and Windows Event Viewer |
| Splunk Web connectivity | Open the configured HTTPS URL using the server name or localhost | The Splunk Web interface loads | Verify the service, URL, port, firewall, name resolution, and port conflicts |
| Administrator login | Complete the first-run administration prompts | Administrator credentials are created or confirmed as requested by the installed release | Follow the displayed recovery or setup guidance and protect the credentials |
| Configured port availability | Test the selected web port locally and remotely from an approved administrative client | The expected endpoint responds and only approved networks can reach it | Check the listener, firewall rules, and competing services |
| Service log review | Review Splunk service logs and Windows Event Viewer when startup or access fails | No errors explain a failed startup or web connection | Use the error details to correct permissions, paths, ports, or security-software interference |
Open Splunk Web
Use HTTPS with the server name or local address and the configured Splunk Web port. With the common default port, the pattern is:
https://<server>:8000For a local test, you can use:
https://localhost:8000Replace 8000 with the actual configured web port. Complete the first-run administration setup shown by your installed version, then confirm that the interface loads and reports a healthy instance. For a separate walkthrough of browser access, see accessing Splunk Web.
Security and operational follow-up
- Use HTTPS for administrative access and protect administrator credentials with your organization's credential-management practices.
- Allow inbound access to the Splunk Web port only from approved administrative networks.
- Permit management-port access, commonly 8089, only where administrative tools, deployment components, or integrations require it.
- Avoid broad local or domain administrator privileges unless the deployment demonstrably needs them.
- Plan backups, upgrades, monitoring, licensing, and data retention after the base installation.
- Configure appropriate data inputs only after confirming the storage and retention design. Related tasks include adding data to Splunk, collecting local Windows event logs, and collecting performance counters.
Troubleshooting
The installer does not start or cannot complete
Common causes include insufficient local privileges, an incomplete or blocked installer, insufficient disk space, or an unsupported Windows environment. Confirm local administrator permissions, verify the installer through the official download source, check endpoint-protection alerts and free space, and review Windows Installer messages for the failing prerequisite or permission.
The domain service account is rejected
Check the domain, username, and password format; account lockout or expiration; domain membership; service-logon rights; local group membership; and organizational service-account policy. Ask the directory administrator to validate the account and use a dedicated approved identity.
The Splunk service does not start
Inspect the Log On account and service status in Windows Services. Then review Splunk service logs and Windows Event Viewer. Check for port conflicts, installation-path permissions, invalid credentials, missing service-logon rights, and security software that may interfere with startup.
Splunk Web is unavailable
Verify that the Splunk service is running and that you are using the configured HTTPS port. Test locally first, then check firewall rules, name resolution, port conflicts, and access from the approved remote network.
Remote Windows data cannot be collected
Validate the selected service identity against one authorized target host. Confirm target-host permissions, required Windows event-log or performance-data access, remote-management and share requirements, DNS, routing, and firewall rules. Grant narrowly scoped permissions based on the specific input and collection method.