topic Re: Splunk Enterprise or Universal Forwarder for Apple Silicon M1 in Splunk Enterprise

Is there a Timeline when Splunk Enterprise and Universal Forwarder will ported to the new Apple Chips?

SierraX — Wed, 16 Mar 2022 14:19:20 GMT

Hi,
since the ~20th of October 2020 Apple sells and deliver several Mac Machines (Mac Mini, MacBook Air and MacBook Pro) with Apple Silicon Chip M1.
Laptops are typically not a main target for things like Splunk Monitoring. But the Mac Mini could be an interesting device for Small Offices (e.g. as SH or HFw) and AdHoc analyses.
At the moment Splunk is just downloadable for MacOS on Intel.
Is there a Timeline when Splunk Enterprise and Universal Forwarder will ported to the new Apple Chips?
Kind Regards
Dirk M.

Re: Splunk Enterprise or Universal Forwarder for Apple Silicon M1

xanthakita — Thu, 08 Apr 2021 00:16:28 GMT

https://www.youtube.com/watch?v=iYOXiwgt-3o. interesting

Re: Splunk Enterprise or Universal Forwarder for Apple Silicon M1

bruzz — Thu, 26 Aug 2021 11:24:49 GMT

Not relevant to the OP's question (which is the reason I came here).

Re: Splunk Enterprise or Universal Forwarder for Apple Silicon M1

isoutamo — Tue, 02 Nov 2021 15:21:47 GMT

Hi
You could run those with rosetta2 at least with M1 chip. I have tested it with several enterprise versions 8.x.x (not yet with UF).
r. Ismo

Re: Splunk Enterprise or Universal Forwarder for Apple Silicon M1

xanthakita — Tue, 02 Nov 2021 15:28:42 GMT

I have since purchased a mac mini with the original M1 and Splunk runs beautifully on it (using Rosetta) there is no noticeable detriment to the operation. I am curious myself if there will ever be an ARM version compiled which would allow Splunk to run bare metal(silicon) on the M1 chip...

Re: Splunk Enterprise or Universal Forwarder for Apple Silicon M1

isoutamo — Tue, 02 Nov 2021 15:35:59 GMT

Haven't found that or even heard rumours about it. But lets hope that they will port it to m1 in some day....
I would like to test it with docker and k8s time by time and currently it needs intel based host.

Re: Splunk Enterprise or Universal Forwarder for Apple Silicon M1

Amusthofa — Wed, 16 Mar 2022 06:48:52 GMT

It works! Really glad we have Rosetta on M1. Now I can have personal Splunk lab env again.

Thanks.

Re: Splunk Enterprise or Universal Forwarder for Apple Silicon M1

Amusthofa — Wed, 16 Mar 2022 06:51:30 GMT

Saw ideas for Splunk Enterprise & Universal Forwarder for M1 at ideas.splunk.com
Unfortunately, for now Splunk Enterprise on M1 is still being considered & Universal Forwarder on M1 still need more votes to even get into considerations.

Re: Splunk Enterprise or Universal Forwarder for Apple Silicon M1

isoutamo — Tue, 17 Jun 2025 21:45:53 GMT

Now there is Splunk Enterprise 10.2.0 beta available on voc.splunk.com. If you want to participate this beta program you need to go that site and apply to this beta. Beta license seems to be valid until November, so probably there are still lot of things which are not ready yet?

I just installed this on M3 max and at least it starts 😉