Splunk Enterprise

Is ARM8 planned to be supported? (AWS EC2 a1 instances)

kirel
New Member

AWS EC2 instance types of 'a1' are using ARM8 processors (aarch64 in Linux). The only Splunk Universal Forwarder download I find for ARM is ARM6, but it appears not to work. Systemd gives the error of "... Failed at step EXEC spawning /opt/splunkforwarder/bin/splunk: Exec format error
-- Subject: Process /opt/splunkforwarder/bin/splunk could not be executed"

Is there a download that I missed?
Or is there an expected timeframe for this to be supported?

Thank you.

  • Jeff
Tags (2)
0 Karma

ericg_splunk
Splunk Employee
Splunk Employee

Please vote for Splunk ARMv8-64 UF here: https://ideas.splunk.com/ideas/APPSID-I-35

This may help for now:
I was able to get the ARMv6, 32-bit Splunk Universal Forwarder to work on a "Raspberry Pi 4" running Ubuntu (19.10 (Eoan Ermine)) using these steps:

  1. dpkg --add-architecture armhf
  2. apt-get update
  3. apt-get install libc6:armhf libstdc++6:armhf
  4. cd /lib
  5. ln -s arm-linux-gnueabihf/ld-2.30.so ld-linux.so.3

Output from "uname -a": Linux ubuntu 5.3.0-1014-raspi2 #16-Ubuntu SMP Tue Nov 26 11:18:23 UTC 2019 aarch64 aarch64 aarch64 GNU/Linux

Running Splunk:
/opt/splunkforwarder/bin/splunk start

Splunk> Map. Reduce. Recycle.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunkforwarder/splunkforwarder-8.0.3-a6754d8441bf-Linux-arm-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...