topic Splunk & Linux Kernel 3.0 in Deployment Architecture

Splunk & Linux Kernel 3.0

dshakespeare_sp — Thu, 18 Apr 2013 13:48:01 GMT

Can Splunk run with Splunk on Linux 3.0/3.1 kernel. The documentation just states 2.6+ but there is nothing explicit Linux 3.0/3.1

Re: Splunk & Linux Kernel 3.0

dwaddle — Thu, 18 Apr 2013 14:07:13 GMT

I would expect the kernel version to largely not matter to Splunk as long as it is relatively modern - that is supports things like NPTL (New POSIX Thread Library) which was a kernel 2.4 feature. The kernel maintainers go to a substantial effort to make sure that no kernel changes break existing user-mode code, and Splunk does not have anything that runs outside of userspace. Sometimes though, the maintainers do mess up and a substantial flap1 comes of it.

But, now be warned of the difference between 'runs' and 'is supported'. If there is a problem, it will be up to Splunk support to decide if they want to commit to supporting these newer kernels at this time.

Re: Splunk & Linux Kernel 3.0

jonuwz — Thu, 18 Apr 2013 18:45:34 GMT

It runs just fine on suse SLES 11 sp2 which has a 3.x kernel. Been running it 24x7 for months with no problem.