Splunk Enterprise expects to run commands using the bash shell, and bash to be available from /bin/sh. On later versions of Debian Linux (for example, Debian Squeeze), the default non-interactive shell is the dash shell. Information on expected default shell and caveats for Debian shells Expand the tar file into an appropriate directory using the tar command:.Confirm that the disk partition has enough space to hold the uncompressed volume of the data you plan to keep indexed.If you want Splunk Enterprise to run as a specific user, you must create the user manually before you install. Splunk Enterprise does not create the splunk user.This method works for any accessible directory on your host file system. In this case, to install in /opt/splunk, either cd to /opt or place the tar file in /opt before you run the tar command. Some non-GNU versions of tar might not have the -C argument available.Knowing the following items helps ensure a successful installation with a tar file:

Tar file installation What to know before installing with a tar file If you are upgrading, see How to upgrade Splunk Enterprise for instructions and migration considerations before you upgrade. The universal forwarder is a separate executable, with a different installation package and its own set of installation procedures.

To install the Splunk universal forwarder, see Install a *nix universal forwarder in the Universal Forwarder manual. You can install Splunk Enterprise on Linux using RPM or DEB packages or a tar file, depending on the version of Linux your host runs.

Install rpm linux