topic Re: Splunk on ARM Achitecture in Splunk Enterprise

Splunk on ARM Achitecture

tcha9078 — Sat, 01 Aug 2020 04:03:56 GMT

Hi,

I am new to SPlunk and I have the following CPU Architecture running Debian Buster 10:

processor : 0
model name : ARMv7 Processor rev 10 (v7l)
BogoMIPS : 6.00
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpd32
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x2
CPU part : 0xc09
CPU revision : 10

Can splunk enterprise will be able run on this system or do I have to use splunk forwarder only?

Re: Splunk on ARM Achitecture

isoutamo — Sat, 01 Aug 2020 08:50:12 GMT

based on this https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements ARM is only supported as UF.

r. Ismo

Re: Splunk on ARM Achitecture

niketn — Sun, 02 Aug 2020 12:15:57 GMT

Wait patiently and it may come 🙂

https://www.linkedin.com/feed/update/urn:li:activity:6691303981484011520/

@MuS 🙂

Re: Splunk on ARM Achitecture

isoutamo — Sun, 02 Aug 2020 13:55:17 GMT

Especially after Apple has changed to ARM processors later on this year...

Re: Splunk on ARM Achitecture

hsesterhenn_spl — Sat, 14 Nov 2020 17:49:21 GMT

Hi,

as mentioned before, only the UF is available for ARMv6 (no support).

Starting with V8.1 there is a fully supported ARMv8 UF available:

https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements

Try this as of November, 14th, 2020:

https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=ARM&platform=linux&version=8.1.0&product=universalforwarder&filename=splunkforwarder-8.1.0-f57c09e87251-Linux-armv8.tgz&wget=true

If you run on Raspberry Pi you might need to install an Ubuntu (or other ARMv8, 64bit) distro because the original Raspbian Linux (Buster) is based on ARMv7 (32 bit).

A full Splunk Enterprise installation is not supported/available currently but if it's for your home environment you might search for QEMU and Splunk Enterprise...

Please mark one of the answers as valid.

Happy splunking,

Holger

Re: Splunk on ARM Achitecture

maat — Wed, 12 Jul 2023 21:21:23 GMT

For those using Linux on Arm, you can run Splunk on a x86 container using docker:

DOCKER_DEFAULT_PLATFORM=linux/amd64 docker run --privileged -d -p 8000:8000 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=<password>" --name splunk splunk/splunk:latest

Re: Splunk on ARM Achitecture

rainmk — Thu, 09 Oct 2025 18:02:17 GMT

The ARM package is available however not publicly visible you have to request access to
https://voc.splunk.com/preview/cmp-graviton-early-access

Re: Splunk on ARM Achitecture

jmel0 — Fri, 07 Nov 2025 06:50:09 GMT

Thanks this was helpful, but it did not fully solve it for me. For anyone else that ends up here, the full solution was as follows:

Test environment: Ubuntu Server 24.04 ARM64 running in a VM on Macbook M3

Install docker

sudo apt install docker.io

sudo systemctl enable docker

sudo systemctl start docker

Pull Splunk Docker Image

Have to add --platform option to specify the pull should be done for amd64 architecture.

sudo docker pull --platform=linux/amd64 splunk/splunk:latest

Install QEMU

Need to install QEMU so docker can use emulation when running amd64 splunk on arm64 linux host. I took this from docker official documentation here: https://docs.docker.com/build/building/multi-platform/ in section about installing QEMU manually.

sudo docker run --privileged --rm tonistiigi/binfmt --install all

Run Splunk Docker Image

Adding --platform is not necessary here, but it avoids a warning

Even though it is not mentioned in the official Splunk documentation (https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/9.3/install-splunk-enterprise-in-virtual-and-containerized-environments/deploy-and-run-splunk-enterprise-inside-a-docker-container) I had to add

-e SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com

because I was getting an error when splunk was starting up. I found the error in the docker logs and it specifically said to add this. Maybe its a new requirement in latest version of splunk.

sudo docker run -d --platform=linux/amd64 -p 8000:8000 -e SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com -e SPLUNK_START_ARGS='--accept-license' -e SPLUNK_PASSWORD='<insert_password>' --name splunk-enterprise splunk/splunk:latest

Note: I initially added --privileged option to above command, but it caused an error in deployment of docker image which was related to app armour and the loaded unix_chkpwd profile which is specific to ubuntu 24.04. The issue was confirmed to be app armor related because running sudo aa-complain unix_chkpwd command caused the error to just turn into a warning and then the docker container started correctly. For some reason, if you do not add --privileged option then this issue is non-existent and so far splunk seems to be running fine.

Re: Splunk on ARM Achitecture

vigmanutd931 — Sat, 17 Jan 2026 06:51:32 GMT

Your steps were spot on and they did get me to the Enterprise dashboard login page, but I’m still unable to actually log in to my instance. I’ve tried:

Resetting the admin password from the CLI.
Re‑using the initial password I set during installation.
Resetting the password again via the “Manage password” prompt in the UI.

Any thoughts on what to check for next?