How to Install Splunk Log Analyzer on Ubuntu Linux

programmer 1653351 640 1
programmer 1653351 640 1

Splunk is a well-known log analyzer that makes sense out of vast data from servers, networking devices and more. It supports most of today’s operating systems and networking devices. The user needs to download the Splunk Installer and run specific commands to install it on Ubuntu systems. Upon installation, Splunk needs to be enabled for startup and a password setup for the web portal access.

Splunk software is a popular log analyzer that you can deploy in your environment to gain insights and help you simplify logs data from servers, networking devices, and others so you can make sense of them.

It helps you monitor, search, and analyze the vast amount of data (especially in larger environments) into a simple format you can easily read and digest.

Splunk supports the majority of the operating systems in use today. From Windows to Linux and Mac OS. Including the vast majority of the networking devices deployed.

For more about Splunk, please check its homepage.

When you’re ready to install Splunk, follow the steps below:

Download Splunk Installer

On Ubuntu systems, you’ll want to download the DEB installer. The commands below can be used to do that.

cd /tmp && wget

The commands above will download version 7.1.1 and save it into the /temp directory. All you need to do now is run the dpkg command and install it.

Install Splunk

Now that the Splunk installer is downloaded, run the commands below to install it.

sudo dpkg -i splunk-7.1.1-8f0ead9ec3db-linux-2.6-amd64.deb

The commands above initiate the installation. I want a few minutes for the installation to complete. When done, you should see the completion messages as shown below.

Selecting previously unselected package splunk.
(Reading database . 165107 files and directories currently installed.)
Preparing to unpack splunk-7.1.1-8f0ead9ec3db-linux-2.6-amd64.deb .
Unpacking splunk (7.1.1) .
Setting up splunk (7.1.1) .

Finally, run the commands below to enable Splunk to always start up when the server starts. For example, the following command starts the service immediately.

sudo /opt/splunk/bin/splunk enable boot-start
sudo service splunk start

You must accept the licensing agreement when you run the above commands. Then, use the spacebar on your keyboard to scroll down the pages. In the end, type y to agree to the terms.

Splunk Software License Agreement 04.24.2018

Do you agree with this license? [y/n]: y

You’ll then be prompted to create and confirm the admin password. Use this password to access the web portal.

This appears to be your first time running this version of Splunk.

An Admin password must be set before installation proceeds.
Password must contain at least:
   * 8 total printable ASCII character(s).
Please enter a new password: 
Please confirm new password: 
Copying '/opt/splunk/etc/openldap/ldap.conf.default' to '/opt/splunk/etc/openldap/ldap.conf'.

Moving '/opt/splunk/share/splunk/search_mrsparkle/' to '/opt/splunk/share/splunk/search_mrsparkle/modules'.
Init script installed at /etc/init.d/splunk.
Init script is configured to run at boot.

Start Splunk.

sudo service splunk start

After that, open your browser and browse to the server hostname or IP address followed by port # 8000


You should see the Splunk web portal for you to access. Then, use the credentials you created above to access the backend.

Splunk ubuntu install


Splunk ubuntu setup

You may also like the post below:

Posted by

I love computers; maybe way too much. What I learned I try to share at

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.