Splunk Enterprise

Is ARM8 planned to be supported? (AWS EC2 a1 instances)

New Member

AWS EC2 instance types of 'a1' are using ARM8 processors (aarch64 in Linux). The only Splunk Universal Forwarder download I find for ARM is ARM6, but it appears not to work. Systemd gives the error of "... Failed at step EXEC spawning /opt/splunkforwarder/bin/splunk: Exec format error
-- Subject: Process /opt/splunkforwarder/bin/splunk could not be executed"

Is there a download that I missed?
Or is there an expected timeframe for this to be supported?

Thank you.

  • Jeff
Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Please vote for Splunk ARMv8-64 UF here: https://ideas.splunk.com/ideas/APPSID-I-35

This may help for now:
I was able to get the ARMv6, 32-bit Splunk Universal Forwarder to work on a "Raspberry Pi 4" running Ubuntu (19.10 (Eoan Ermine)) using these steps:

  1. dpkg --add-architecture armhf
  2. apt-get update
  3. apt-get install libc6:armhf libstdc++6:armhf
  4. cd /lib
  5. ln -s arm-linux-gnueabihf/ld-2.30.so ld-linux.so.3

Output from "uname -a": Linux ubuntu 5.3.0-1014-raspi2 #16-Ubuntu SMP Tue Nov 26 11:18:23 UTC 2019 aarch64 aarch64 aarch64 GNU/Linux

Running Splunk:
/opt/splunkforwarder/bin/splunk start

Splunk> Map. Reduce. Recycle.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for problems...
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunkforwarder/splunkforwarder-8.0.3-a6754d8441bf-Linux-arm-manifest'
All installed files intact.
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...