Installation

Cannot install more than one Splunk Instance on Mac OS using .dmg

Lionel
Splunk Employee
Splunk Employee

Hello,

Every time, I install a a second instance of Splunk (same machine, just in a different directory), using the .dmg installer, my original instance gets corrupted and will not work. Multiple directories disappear and of course, I can't execute any of the commands.

My use case is to have two instance for testing purposes.

Thanks

Tags (2)
1 Solution

Mick
Splunk Employee
Splunk Employee

http://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine

The link above will take you to instructions on how to successfully configure & run multiple instances on a single machine. The problem you are encountering is a known behaviour on Mac OS X. In running the install package for the second time, the OS inadvertently clobbers the original install, removing files and directories.

Usually it will leave the '$SPLUNK_HOME/etc' and '$SPLUNK_HOME/var' directories intact, so your configurations & data should still exist, but the instance will not be in a usable state and the best option at this point is to move what is left aside, download the .tgx package, extract it to the desired location and move your configs and data back over.

Assuming your 2nd instance installed succesfully when you ran the .dmg that caused this problem, you should now have 2 instances on one machine. Please read the steps in the article linked above to ensure that there are no conflicts between the instances.

View solution in original post

Mick
Splunk Employee
Splunk Employee

http://wiki.splunk.com/Community:Run_multiple_Splunks_on_one_machine

The link above will take you to instructions on how to successfully configure & run multiple instances on a single machine. The problem you are encountering is a known behaviour on Mac OS X. In running the install package for the second time, the OS inadvertently clobbers the original install, removing files and directories.

Usually it will leave the '$SPLUNK_HOME/etc' and '$SPLUNK_HOME/var' directories intact, so your configurations & data should still exist, but the instance will not be in a usable state and the best option at this point is to move what is left aside, download the .tgx package, extract it to the desired location and move your configs and data back over.

Assuming your 2nd instance installed succesfully when you ran the .dmg that caused this problem, you should now have 2 instances on one machine. Please read the steps in the article linked above to ensure that there are no conflicts between the instances.

dart
Splunk Employee
Splunk Employee

I use the .tar.gz downloads to have multiple instances, would that work for you?

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – August 2026

MichelleCorpora_1-1788182384472.png Welcome to the August 2026 edition of Data Management Digest! August was a ...

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...