Splunk on ARM Achitecture

[tcha9078]

Hi,

I am new to SPlunk and I have the following CPU Architecture running Debian Buster 10:

processor : 0
model name : ARMv7 Processor rev 10 (v7l)
BogoMIPS : 6.00
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpd32
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x2
CPU part : 0xc09
CPU revision : 10

Can splunk enterprise will be able run on this system or do I have to use splunk forwarder only?

[maat]

For those using Linux on Arm, you can run Splunk on a x86 container using docker:

DOCKER_DEFAULT_PLATFORM=linux/amd64 docker run --privileged -d -p 8000:8000 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=<password>" --name splunk splunk/splunk:latest

[hsesterhenn_spl · Accepted solution]

Hi,

as mentioned before, only the UF is available for ARMv6 (no support).

Starting with V8.1 there is a fully supported ARMv8 UF available:

https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements

Try this as of November, 14th, 2020:

https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=ARM&platform=linux&version=8....

If you run on Raspberry Pi you might need to install an Ubuntu (or other ARMv8, 64bit) distro because the original Raspbian Linux (Buster) is based on ARMv7 (32 bit).

A full Splunk Enterprise installation is not supported/available currently but if it's for your home environment you might search for QEMU and Splunk Enterprise... 

Please mark one of the answers as valid.

Happy splunking,

Holger

[niketn]

Wait patiently and it may come 🙂

https://www.linkedin.com/feed/update/urn:li:activity:6691303981484011520/

@MuS 🙂

[isoutamo]

Especially after Apple has changed to ARM processors later on this year...

[isoutamo]

Hi

based on this https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements ARM is only supported as UF. 

r. Ismo