Deployment Architecture

Splunk & Linux Kernel 3.0

Splunk Employee
Splunk Employee

Can Splunk run with Splunk on Linux 3.0/3.1 kernel. The documentation just states 2.6+ but there is nothing explicit Linux 3.0/3.1

Tags (1)


It runs just fine on suse SLES 11 sp2 which has a 3.x kernel. Been running it 24x7 for months with no problem.

0 Karma


I would expect the kernel version to largely not matter to Splunk as long as it is relatively modern - that is supports things like NPTL (New POSIX Thread Library) which was a kernel 2.4 feature. The kernel maintainers go to a substantial effort to make sure that no kernel changes break existing user-mode code, and Splunk does not have anything that runs outside of userspace. Sometimes though, the maintainers do mess up and a substantial flap1 comes of it.

But, now be warned of the difference between 'runs' and 'is supported'. If there is a problem, it will be up to Splunk support to decide if they want to commit to supporting these newer kernels at this time.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...