Security

How to fix this Error on starting Splunk on UBUNTU (on my apple Mac pro)?

splunkis0927
Engager

root@ubuntu-linux-22-04-desktop:/opt/splunk/bin# uname -a
Linux ubuntu-linux-22-04-desktop 5.15.0-48-generic #54-Ubuntu SMP Fri Aug 26 13:31:33 UTC 2022 aarch64 aarch64 aarch64 GNU/Linux

 

sudo tar xvzf splunk-9.0.1-82c987350fde-Linux-x86_64.tgz -C /opt


root@ubuntu-linux-22-04-desktop:/opt/splunk/bin# sudo ./splunk start --accept-license
./splunk: 1: Syntax error: Unterminated quoted string
root@ubuntu-linux-22-04-desktop:/opt/splunk/bin#

 

Error on starting Splunk on UBUNTU (using Parallels Desktop on my apple Mac pro)

 Model Name: MacBook Pro

  Model Identifier: MacBookPro18,1

  Chip: Apple M1 Pro

  Total Number of Cores: 10 (8 performance and 2 efficiency)

  Memory: 16 GB

 

 

 

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Have you bash or dash in use? I think that only the bash is supported on Ubuntu.

0 Karma

splunkis0927
Engager

Thanks for the reply,

looks bash is in use,

root@ubuntu-linux-22-04-desktop:/opt/splunk/bin# echo "$SHELL"
/bin/bash

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I just realise that you have M1 chip on your Mac. You cannot run splunk with it in linux as the architecture is different, only x84 version is supported by splunk. If you want to use splunk on M1/M2 Macs you must run it under macOS and then Rosetta2 will handling emulation between x86 and M-series.

Here is idea https://ideas.splunk.com/ideas/EID-I-515 where is asked that splunk should run also on ARM. It's already in prospect phase, but probably it's still good to give a vote for it 😉

0 Karma

noobpentester
New Member

Hi,

I was wondering can i install splunk while running kali linux on vmware fusion on my macbook m1?

I can't seem to get it to install it gives me an error when i type in the command ./splunk start -accept-license.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Currently Splunk is supported only in x86 based linux systems not ARM based. So you cannot run it on your M1.

I'm not sure how well new Parallels will work and does it have small kind of "rosetta" support for linux vms than macOS have? If I recall right there was already that support for 8x6 windows?

Maybe this helps you https://apple.stackexchange.com/questions/450364/parallels-18-already-supports-windows-x64-on-m1 even it's not exactly what you have asked? I haven't try it by myself.

0 Karma
Get Updates on the Splunk Community!

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...