SPLUNK INSTALLATION GUIDE INSTALL
SPLUNK INSTALLATION GUIDE SERIES
SPLUNK INSTALLATION GUIDE WINDOWS

This input initially writes a baseline for the Registry in its current state (if requested), then monitors changes to the Registry over time. Splunk-regmon.exe runs when you configure a Registry monitoring input in Splunk.

SPLUNK INSTALLATION GUIDE WINDOWS

Splunk-netmon runs when you configure Splunk Enterprise to monitor Windows network information on the local machine. This binary attaches to the Performance Data Helper libraries, which query the performance libraries on the system and extract performance metrics both instantaneously and over time. Splunk-perfmon.exe runs when you configure Splunk Enterprise to monitor performance data on the local Windows machine. Splunk Enterprise stores these events in an index. splunkd spawns splunk-admon, which attaches to the nearest available AD domain controller and gathers change events generated by AD.

Splunk-admon.exe runs whenever you configure an Active Directory (AD) monitoring input.

SPLUNK INSTALLATION GUIDE INSTALL

This is not an issue if you install Splunk Enterprise as the Local System user. Splunk Enterprise might not function correctly if this program does not have the appropriate permissions on your Windows system. The splunk.exe binary requires an elevated context to run because of how it controls the splunkd and splunkweb processes. It lets you start, stop, and configure Splunk Enterprise, similar to the *nix splunk program. It provides the command-line interface (CLI) for the program. Splunk.exe is the control application for the Windows version of Splunk Enterprise. These inputs run when configured by certain types of Windows-specific data input. On Windows instances of Splunk Enterprise, in addition to the two services described, Splunk Enterprise uses additional processes when you create specific data inputs on a Splunk Enterprise instance. If you attempt to start Splunk Enterprise from the Start Menu while in Safe Mode, Splunk Enterprise does not alert you to the fact that its services are not running.Īdditional processes for Splunk Enterprise on Windows If Windows is in Safe Mode, Splunk services do not start. Splunk Enterprise and Windows in Safe Mode Read information on other Windows third-party binaries that come with Splunk Enterprise.

Because it is a renamed file, it does not contain the same file version information as other Splunk Enterprise for Windows binaries. On Windows systems, splunkweb.exe is a third-party, open-source executable that Splunk renames from pythonservice.exe. You can configure it to run in 'legacy mode' by changing a configuration parameter. Now, it installs and runs, but quits immediately. Prior to version 6.2, it provided the Web interface for Splunk Enterprise. Splunkweb installs as a legacy service on Windows only. For a table and diagrams showing the network ports used, see Components and their relationship with the network in the Inherit a Splunk Enterprise Deployment manual. Splunk Enterprise processes require network connectivity. It also runs a Web server on port 8000 with SSL/HTTPS turned off by default.splunkd runs a Web server on port 8089 with SSL/HTTPS turned on by default.It communicates with your Web browser through REpresentational State Transfer (REST). It lets users search and navigate data and manage Splunk Enterprise deployment through a Web interface. New for version 6.2, splunkd also provides the Splunk Web user interface.Pipelines can pass data to one another through queues.

Processors are individual, reusable C or C++ functions that act on the stream of IT data that passes through a pipeline.

Pipelines are single threads inside the splunkd process, each configured with a single snippet of XML.

SPLUNK INSTALLATION GUIDE SERIES

splunkd processes and indexes your data by streaming it through a series of pipelines, each made up of a series of processors. Splunkd is a distributed C/C++ server that accesses, processes and indexes streaming IT data. If you're looking for information about third-party components used in Splunk Enterprise, see the credits section in the Release notes.Ī Splunk Enterprise server installs a process on your host, splunkd. This topic discusses the internal architecture and processes of Splunk Enterprise at a high level.

Splunk Enterprise architecture and processes

Splunk installation guide