IS it possible to install Splunk on Ubuntu on Windows?

[CrypToki]

I tried to installed Splunk 7.0 to Ubuntu on Windows 10. The startup is failing the locktest with the following:

./locktest
Could not create a lock in the SPLUNK_DB directory.
Filesystem type is not supported: buf.f_type = 0x53464846
If supporting this filesystem type is important to you, please file an Enhancement Request with Splunk Support with the fs info number listed.

The main purpose for this is to test out Linux installation without having to spin up a VM. Performance and scalability isn't the goal.

[xpac]

I would really advise not to do this.
The Windows Linux Subsystem is nice, but it's far from perfect, and you will run into a bunch of problems using it with something as advanced as Splunk. It lacks a lot of more advanced features, and it is not worth the trouble you'll have with it - instead just spin up a VM 😉

Edit: Sorry for thread necro, it popped up in and I didn't check the timestamp 0=)

[Nextbeat]

I was able to install Splunk through WSL several times successfully. The last installation yielded a similar error. If you receive an "unusable filesystem" error or similar, try the following:

$ echo -e "\nOPTIMISTIC_ABOUT_FILE_LOCKING = 1" >> /opt/splunk/etc/splunk-launch.conf"

This answer was from @naisanza and had the following warning:

Proceed with caution, and at your own risk. Irrevocable data loss can still occur. We have already had one report in this thread of problems that have occurred after enabling this setting.

[anjambha]

Hi CrypToki,

Do you want to install splunk on the Ubuntu/Windows OS? if yes

Then I will suggest you to first check your OS (32/64) bit accordingly download Splunk version from below link.. and try to install

https://www.splunk.com/en_us/download/splunk-enterprise.html

For Ubantu.. from Linux tab you can download .tgz file ... and use below command to install Splunk.

1. tar -xvzf <file path> -C /opt
2. /opt/splunk/bin/splunk start

[CrypToki]

I have no problem installing the Linux version of Splunk on a stand-alone Linux install and this works well.

My query is related to Windows Subsystem for Linux (WSL) running Ubuntu. Microsoft uses a filesystem called 'lxfs'

Using:
declare -x SPLUNK_DB="/opt/splunk/var/lib/splunk"

The locktest is failing with the following:
root@ComputerName:/opt/splunk/bin# ./locktest
Could not create a lock in the SPLUNK_DB directory.
Filesystem type is not supported: buf.f_type = 0x53464846
If supporting this filesystem type is important to you, please file an Enhancement Request with Splunk Support with the fs info number listed.

Under /opt/splunk/var/lib/splunk the tests files are created (for example):
root@ComputerName:/opt/splunk/bin# ls -la /opt/splunk/var/lib/splunk
total 0
drwx------ 0 root root 4096 Nov 14 22:19 .
drwx--x--- 0 root root 4096 Nov 13 23:19 ..
drwx------ 0 root root 4096 Nov 13 23:19 audit
drwx------ 0 root root 4096 Nov 13 23:19 authDb
drwx------ 0 root root 4096 Nov 13 23:19 hashDb
drwx------ 0 root root 4096 Nov 13 23:25 persistentstorage
-rw------- 1 root root 0 Nov 14 22:19 test.7mL8p3
-rw------- 1 root root 0 Nov 13 23:44 test.WwIt7T
-rw------- 1 root root 0 Nov 13 23:35 test.Yfyo0Q

Mount is showing the filesystem for / as 'lxfs'

root@ComputerName:/opt/splunk/bin# mount
rootfs on / type lxfs (rw,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
none on /dev type tmpfs (rw,noatime,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,noatime)
none on /run type tmpfs (rw,nosuid,noexec,noatime,mode=755)
none on /run/lock type tmpfs (rw,nosuid,nodev,noexec,noatime)
none on /run/shm type tmpfs (rw,nosuid,nodev,noatime)
none on /run/user type tmpfs (rw,nosuid,nodev,noexec,noatime,mode=755)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noatime)
C: on /mnt/c type drvfs (rw,noatime)