Elasticsearch -> Splunk : Getting started?

New Member

Good morning. I support a application development effort which is transitioning from Elasticsearch to Splunk. 

I would like to setup a POC test instance/cluster of splunk on our dev network.

With elastic, I would dimply download an RPM ang get started.

With splunk, it is unclear to me how to get started (reading docs), regarding licensing and which files I can download.

Apologies for the low level questions, but where can I get started?  Which file can I download to start install an instance, and hopefully created a small (3/4 node) cluster for POC?



Labels (2)
0 Karma


I recommend starting with a single standalone instance of Splunk before venturing into clustering.  Walk before you run.

As for which file to download, you will need to start with Splunk Enterprise so go to and download the RPM. Don't worry about licensing as it comes with a built-in 60-day license.

Depending on where your data resides, you may also need to download and installed one or more Universal Forwarders from and configure it to send data to the Splunk Enterprise instance.  See for how to do that.

If this reply helps you, an upvote would be appreciated.
0 Karma


Hi @lrodrigues99,

with Splunk you can download a free instance (max 500 MB/day) and use it for 60 days with full features, and then with a subset of features.

If for your PoC you need more volume of logs, you can ask to Splunk a trial version for a more limited time period (usually 2 weeks).

To download a free installation you need only an account on

Installation depends on the Operative system you're using for the Splunk server.

If Linux, you have to download an rpm or a tar, explode it and then run a command.

./splunk start --accept-license

You can find the installation procedure at

You can also find some videos that describe this procedure



0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!