topic Re: Splunk enterprise on the new Mac m1 under Rosetta in Splunk Enterprise

Has anyone tried to run Splunk Enterprise under Rosetta on the new Mac M1 chip?

xanthakita — Mon, 30 May 2022 23:32:48 GMT

Has anyone tried to run Splunk Enterprise under Rosetta on the new Mac M1 chip? I realize it’s compiled for intel, but supposedly Rosetta works pretty well at interpreting. I am considering purchasing a Mac mini but I want to be able to run Splunk on it for development and testing.

any insights or experience with this?

Re: Splunk enterprise on the new Mac m1 under Rosetta

xanthakita — Thu, 08 Apr 2021 00:17:03 GMT

discovered this youtube video: https://www.youtube.com/watch?v=iYOXiwgt-3o

Re: Splunk enterprise on the new Mac m1 under Rosetta

isoutamo — Tue, 02 Nov 2021 15:24:27 GMT

As You have seen, it works great with M1 chips.
Have you try to run it with docker on M1?
r. Ismo

Re: Splunk enterprise on the new Mac m1 under Rosetta

xanthakita — Tue, 02 Nov 2021 15:49:52 GMT

Sadly I haven't come up to speed on Splunk in containers.. even though I really want to! I would think it would do fine since according to this: https://www.youtube.com/watch?v=wsg7wrTbBRk Docker is supported...

it would certainly be interesting to test.

Re: Splunk enterprise on the new Mac m1 under Rosetta

effem2 — Mon, 30 May 2022 14:00:48 GMT

Splunk Docker container do not currently work. As Splunk Software(possibly WebServer) is running into a QEMU Bug.

qemu: uncaught target signal 11 (Segmentation fault) - core dumped

The container works but Splunk upon starting the Webserver will fail due to this issue.
As there is no ARM64 version of Splunk Enterprise, there is only one workaround, that is to install locally.