Splunk on ARM Achitecture

[tcha9078]

Hi,

I am new to SPlunk and I have the following CPU Architecture running Debian Buster 10:

processor : 0
model name : ARMv7 Processor rev 10 (v7l)
BogoMIPS : 6.00
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpd32
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x2
CPU part : 0xc09
CPU revision : 10

Can splunk enterprise will be able run on this system or do I have to use splunk forwarder only?

[maat]

For those using Linux on Arm, you can run Splunk on a x86 container using docker:

DOCKER_DEFAULT_PLATFORM=linux/amd64 docker run --privileged -d -p 8000:8000 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=<password>" --name splunk splunk/splunk:latest

[jmel0]

Thanks this was helpful, but it did not fully solve it for me. For anyone else that ends up here, the full solution was as follows:

Test environment: Ubuntu Server 24.04 ARM64  running in a VM on Macbook M3

Install docker

sudo apt install docker.io

sudo systemctl enable docker

sudo systemctl start docker

Pull Splunk Docker Image

Have to add --platform option to specify the pull should be done for amd64 architecture. 

sudo docker pull --platform=linux/amd64 splunk/splunk:latest

Install QEMU 

Need to install QEMU so docker can use emulation when running amd64 splunk on arm64 linux host. I took this from docker official documentation here: https://docs.docker.com/build/building/multi-platform/ in section about installing QEMU manually.

sudo docker run --privileged --rm tonistiigi/binfmt --install all

Run Splunk Docker Image

Adding --platform is not necessary here, but it avoids a warning

Even though it is not mentioned in the official Splunk documentation (https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/9.3/install-splunk-ente...) I had to add

-e SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com

because I was getting an error when splunk was starting up. I found the error in the docker logs and it specifically said to add this. Maybe its a new requirement in latest version of splunk.

sudo docker run -d --platform=linux/amd64 -p 8000:8000 -e SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com -e SPLUNK_START_ARGS='--accept-license' -e SPLUNK_PASSWORD='<insert_password>' --name splunk-enterprise splunk/splunk:latest

Note: I initially added --privileged option to above command, but it caused an error in deployment of docker image which was related to app armour and the loaded unix_chkpwd profile which is specific to ubuntu 24.04. The issue was confirmed to be app armor related because running sudo aa-complain unix_chkpwd  command caused the error to just turn into a warning and then the docker container started correctly. For some reason, if you do not add --privileged  option then this issue is non-existent and so far splunk seems to be running fine.

[hsesterhenn_spl · Accepted solution]

Hi,

as mentioned before, only the UF is available for ARMv6 (no support).

Starting with V8.1 there is a fully supported ARMv8 UF available:

https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements

Try this as of November, 14th, 2020:

https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=ARM&platform=linux&version=8....

If you run on Raspberry Pi you might need to install an Ubuntu (or other ARMv8, 64bit) distro because the original Raspbian Linux (Buster) is based on ARMv7 (32 bit).

A full Splunk Enterprise installation is not supported/available currently but if it's for your home environment you might search for QEMU and Splunk Enterprise... 

Please mark one of the answers as valid.

Happy splunking,

Holger

[niketn]

Wait patiently and it may come 🙂

https://www.linkedin.com/feed/update/urn:li:activity:6691303981484011520/

@MuS 🙂

[isoutamo]

Especially after Apple has changed to ARM processors later on this year...

[isoutamo]

Hi

based on this https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements ARM is only supported as UF. 

r. Ismo

[rainmk]

The ARM package is available however not publicly visible you have to request access to 
https://voc.splunk.com/preview/cmp-graviton-early-access