topic Re: Running Splunk on Raspberry Pi 3 in Splunk Dev

Running Splunk on Raspberry Pi 3

calebra05 — Fri, 09 Sep 2016 11:01:39 GMT

Dear Splunkers,

I would like to install Splunk on my Raspberry Pi 3 just to monitor some (network) devices (one NAS, one router and a PC at first) at home.
Does Pi3 has enough hardware resource to run Splunk (and maybe other services)?

Here are the specifications:
SoC: Broadcom BCM2837
CPU: 4× ARM Cortex-A53, 1.2GHz
GPU: Broadcom VideoCore IV
RAM: 1GB LPDDR2 (900 MHz)

Thank you in advance!

Re: Running Splunk on Raspberry Pi 3

martin_mueller — Fri, 09 Sep 2016 12:35:35 GMT

As far as I'm aware there are no Splunk Enterprise binaries compiled for ARM available, just a universal forwarder: http://blogs.splunk.com/2013/10/11/introducing-the-splunk-universal-forwarder-for-raspberry-pi/

Re: Running Splunk on Raspberry Pi 3

calebra05 — Mon, 12 Sep 2016 10:39:30 GMT

It's a pity, but thank you for the answer.

Re: Running Splunk on Raspberry Pi 3

Lowell — Wed, 19 Apr 2017 19:21:34 GMT

Please note that recent version of the Raspberry PI Splunk UF is available from the regular universal forwarder download page, under the Linux tab. Look for the "ARMv6" architecture. The package is available as a *.tgz file.

(The announcement link above, links to the app on Splunk base (which is really an old 6.0 download). The latest version is supported by Splunk and available via the standard download channel.)

Re: Running Splunk on Raspberry Pi 3

BongoTheWhippet — Mon, 08 Oct 2018 02:03:12 GMT

That download actually fails (neither the wget or the direct link work anymore) so the OP is correct - there's no more options for Raspberry Pi forwarding which is a shame as it is the No. 1 selling computer in the world!

Re: Running Splunk on Raspberry Pi 3

MuS — Mon, 08 Oct 2018 02:19:52 GMT

Well, there is a ARMv6 version of the UF to download here https://www.splunk.com/en_us/download/universal-forwarder.html#tabs/linux and I was able to download splunkforwarder-7.2.0-8c86330ac18-Linux-arm.tgz from there.

Also I was able to download an older version using wget like this:

wget -O splunkforwarder-6.6.0-1c4f3bbe1aea-Linux-arm.tgz 'https://www.splunk.com/page/download_track?file=6.6.0/linux/splunkforwarder-6.6.0-1c4f3bbe1aea-Linux-arm.tgz&ac=&wget=true&name=wget&platform=Linux&architecture=ARM&version=6.6.0&product=universalforwarder&typed=release'

cheers, MuS

Re: Running Splunk on Raspberry Pi 3

BongoTheWhippet — Mon, 08 Oct 2018 02:27:58 GMT

Ah indeed, you can download from the webpage, but the latest 7.2.x version fails to wget correctly.

Not ideal, but workable if you grab it from the webpage and SCP it to your RPi.

Thanks.