Splunk install-Linux

RedHat RPM install

   

If you are upgrading, review "How to upgrade Splunk" for instructions and migration considerations before proceeding.

To install the Splunk RPM in the default directory /opt/splunk:

rpm -i splunk_package_name.rpm

To install Splunk in a different directory, use the --prefix flag:

rpm -i --prefix=/opt/new_directory splunk_package_name.rpm

To upgrade an existing Splunk installation that resides in /opt/splunk using the RPM:

rpm -U splunk_package_name.rpm

To upgrade an existing Splunk installation that was done in a different directory, use the --prefix flag:

rpm -U --prefix=/opt/existing_directory splunk_package_name.rpm

Note: If you do not specify with --prefix for your existing directory, rpm will install in the default location of/opt/splunk.

For example, to upgrade to the existing directory of $SPLUNK_HOME=/opt/apps/splunk enter the following:

rpm -U --prefix=/opt/apps splunk_package_name.rpm

If you want to automate your RPM install with kickstart, add the following to your kickstart file:

./splunk start --accept-license
./splunk enable boot-start

Note: The second line is optional for the kickstart file.

   

Debian DEB install

To install the Splunk DEB package:

dpkg -i splunk_package_name.deb

Note: You can only install the Splunk DEB package in the default location, /opt/splunk.

   

Tar File Install

To install Splunk on a Linux system, expand the tarball into an appropriate directory using the tar command:

tar xvzf splunk_package_name.tgz

The default install directory is splunk in the current working directory. To install into /opt/splunk, use the following command:

tar xvzf splunk_package_name.tgz -C /opt

Note: When you install Splunk with a tarball:

• Some non-GNU versions of tar might not have the -C argument available. In this case, if you want to install in /opt/splunk, either cd to /opt or place the tarball in /opt before running the tar command. This method will work for any accessible directory on your machine's filesystem.
• Splunk does not create the splunk user automatically. If you want Splunk to run as a specific user, you must create the user manually before installing.
• Ensure that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.

     

• Tar File Install를 형태로 설치진행

  -> 해당 리눅스 비트에 맞는 tgz 파일 다운(http://www.splunk.com/download?ac=get_splunk_download)

  -> /opt 해당 위치에 압축을 풀어주시면 되겠습니다.

     

  What gets Installed

     

  Splunk package status:

  dpkg --status splunk

  List all packages:

  dpkg --list

     

  Start Splunk

     

  Splunk can run as any user on the local system. If you run Splunk as a non-root user, make sure that Splunk has the appropriate permissions to read the inputs that you specify. Refer to the instructions for running Splunk as a non-root user for more information.

  To start Splunk from the command line interface, run the following command from $SPLUNK_HOME/bin directory (where $SPLUNK_HOME is the directory into which you installed Splunk):

  ./splunk start

  By convention, this document uses:

• $SPLUNK_HOME to identify the path to your Splunk installation.
• $SPLUNK_HOME/bin/ to indicate the location of the command line interface.

     

  Startup options

  The first time you start Splunk after a new installation, you must accept the license agreement. To start Splunk and accept the license in one step:

  $SPLUNK_HOME/bin/splunk start --accept-license

  Note: There are two dashes before the accept-license option.

     

  Launch Splunk Web and log in

  After you start Splunk and accept the license agreement,

  1. In a browser window, access Splunk Web at http://<hostname>:port. --해당 방식으로 Splunk 접속완료

  hostname is the host machine.

• port is the port you specified during the installation (the default port is 8000).

  2. Splunk Web prompts you for login information (default, username admin and password changeme) before it launches. If you switch to Splunk Free, you will bypass this logon page in future sessions. --처음 유저명과 패스워드의 경우 위와 동일

  Now that you've installed Splunk, what comes next?

     

  RedHat Linux

  To uninstall from RedHat Linux

  rpm -e splunk_product_name

     

  Debian Linux

  To uninstall from Debian Linux:

  dpkg -r splunk

  To purge (delete everything, including configuration files):

  dpkg -P splunk

     

  원본 위치 <http://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonLinux>