We stand with Ukraine to help keep people safe. Join us

Indexes logs from any source.

Based on 6 user ratesRead reviews & comments

Splunk overview

Note: Splunk is available in a limited free version, a cloud version, and an enterprise version. Contact a sales representative for pricing info.

Splunk Server indexes logs from ANY source (apache, OS X, sendmail, routers). No need to configure it for specific formats, write regular expressions, or change your logging output.

Search mountains of data by time, keywords, type of event, source, host, or relationships to other events. Note: Splunk is server software. You configure and use the software via a Web browser.

What’s new in version 6.3.0

Updated on Sep 28 2015

Version 6.3.0:

Note: Now requires OS X 10.9 or later.

  • Search Parallelization. Optimized CPU utilization for faster search execution. See "Manage report acceleration", "Accelerate data models", and "Configure batch mode search" in the Knowledge Manager Manual.
  • Index Parallelization. Optimized CPU utilization for faster data ingestion.
  • Intelligent Job Scheduling. Intelligent job scheduling provides improved system utilization and predictable performance. See "Configure the priority of scheduled reports" in the Reporting Manual.
  • Data Integrity Control. Data integrity control ensures that indexed data has not been modified. See "Manage data integrity" in the Securing Splunk Enterprise manual.
  • Single Sign-On Using SAML. Support for SAML 2.0 for single sign-on using PingFederate as the Identity Provider. See "About single sign-on using SAML" in the Securing Splunk Enterprise manual.
  • Search Head Clustering Improvements. Performance optimization, scalability, and management improvements. Support for Windows OS.
  • Indexer Clustering Improvements. Ability to turn off search affinity. See "Implement search affinity in a multisite indexer cluster" in the Managing Indexers and Clusters of Indexers manual.
  • HTTP Event Collector. Indexing of high-volume JSON-based application and IOT data sent directly via a secure, scalable HTTP endpoint. No Forwarder required. See "Use the HTTP Event Collector" in the Getting Data In manual.
  • Custom Alert Actions. Customizable alert actions and packaged integrations with popular third-party applications or messaging systems. See "Custom alert actions overview" in the Developing Views and Apps for Splunk Web manual.
  • Key Value Store - Distributed Lookups. Allows App developers to do KV Store lookups on remote indexers to improve efficiency in large scale distributed environments. See "About the app key value store" in the Admin Manual.
  • Key Value Store - Lookup Filtering. Allows App developers to filter lookup data without requiring subsequent searches. See "About the app key value store" in the Admin Manual.
Management and Administration
  • HTTP Event Collector Configuration. Create and manage configurations for the HTTP Event Collector. See "Use the HTTP Event Collector" in the Getting Data In manual.
  • Source Type Manager. Create and manage source type configurations independent of getting data in, and search within the source type picker. See "Manage source types" in the Getting Data In manual.
  • Powershell Input. Native support for ingesting data retrieved by Powershell scripts. See the Splunk Add-on for Microsoft PowerShell manual.
  • App Browsing Interface. Automates and simplifies app and add-on discovery within Splunk Web.
  • Indexer Auto-Discovery. Forwarders now dynamically retrieve indexer lists from cluster master to enable elastic deployments. See "Use indexer discovery to connect forwarders to peer nodes" in the Managing Indexers and Clusters of Indexers manual.
  • Distributed Management Console. New topology views, status, and alerting for Splunk platform deployments including: indexers, search heads, forwarders, and storage utilization. See "About the distributed management console" in the Distributed Management Console Manual.
  • Field Extractor Enhancements. Simplified field extraction via delimiter and header selection. Displays field extractions within the event preview. See "Build field extractions with the field extractor" in the Knowledge Manager Manual.
  • Search Process Memory Usage Threshold. New configuration parameters to specify the maximum physical memory usage that a single search process can consume. See the search_process_memory_usage_threshold and search_process_memory_usage_percentage_threshold stanzas in "limits.conf" in the Admin Manual.
  • Single Value Display. Support for at-a-glance, single-value indicators with historical context and change indicators. See the "Single value visualizations" section of "Visualization Reference" in the Dashboards and Visualizations manual.
  • Geospatial Visualization. Support for choropleth maps to visualize how a metric varies across a customizable geographic area. See "Mapping data" in the Dashboards and Visualizations manual.
  • Dashboard Enhancements. More powerful dashboards with extended search and token management. See "Token usage in dashboards" in the Dashboards and Visualizations manual.
  • Search History. View and interact with ad-hoc search command history. See "View and interact with your Search History" in the Search Manual.
  • Anomaly Detection. New SPL command that offers histogram based approach for detecting anomalies. Also includes the capabilities of existing anomalousvalue and outlier SPL commands. See "anomalydetection" in the Search Reference manual.
  • Search Helper Improvements. Re-architected to improve responsiveness.
  • Java logger Support for HTTP Event Collector. Adds support for log4j, logback and java.util.logging to allow logging from Java apps over HTTP.
  • .NET Logger support for HTTP Event Logger. Adds support for the .NET Trace Listener API and SLAB (Semantic Logging Application Block) to allow logging from apps over HTTP.
  • Custom Alert Actions. Allows developers to build, package, and integrate custom alert actions as native to Splunk software. See "Custom alert actions overview" in the Developing Views and Apps for Splunk Web manual.
  • Key Value Store - Distributed Lookups. Allows App developers to do KV Store lookups on remote indexers to improve efficiency in large scale distributed environments. See "About the app key value store" in the Admin Manual.
  • Key Value Store - Lookup Filtering. Allows App developers to filter lookup data without requiring subsequent searches. See "About the app key value store" in the Admin Manual.
  • The Distributed Management Console Manual provides dedicated information on the distributed management console that was introduced in Splunk Enterprise 6.2.
  • The Distributed Deployment Manual has been substantially expanded to provide enhanced guidance on implementing, maintaining, and expanding a distributed deployment. In particular, it now features a set of end-to-end implementation frameworks for common deployment scenarios.
  • The Getting Data In manual has been reorganized to provide faster access to the information you need to get your data into Splunk Enterprise. The manual includes information on updated features, and content within the book has been reorganized to make procedures easier to understand and follow.
  • The Forwarding Data manual has been updated to make the installation instructions for the universal forwarder more accessible, and to better group and clarify universal forwarder concepts and activities in deployments of the Splunk platform.
  • data/inputs/http
  • data/inputs/http/{name}
  • data/inputs/http/{name}/disable
  • data/inputs/http/{name}/enable
  • licenser/usage
  • services/collector/event
  • services/collector/mint
  • services/data/ui/alerts
  • servicesNS/{user}/{app}/data/ui/alerts
  • services/server/introspection/search/dispatch/Bundle_Directory_Reaper
  • services/server/introspection/search/dispatch/Dispatch_Directory_Reaper
  • services/server/introspection/search/dispatch/Search_StartUp_Time
  • services/server/introspection/search/distributed
  • services/server/introspection/search/saved
  • services/search/scheduler
  • services/search/scheduler/scheduler

View the complete release notes.

View older Splunk updates





139.6 MB



App requirements

  • Intel 64
  • OS X 10.9 or later
Try our new feature and write a detailed review about Splunk. All reviews will be posted soon.
Write your thoughts in our old-fashioned comment
MacUpdate Comment Policy. We strongly recommend leaving comments, however comments with abusive words, bullying, personal attacks of any type will be moderated.
(0 Reviews of )
There are no reviews yet
Feb 25 2014
Feb 25 2014
Version: 6.0.2
Works Great on Mavericks.
May 31 2013
May 31 2013
Version: 5.0.3
Wow @Mutant is right...this is NOT FREE. More like TRIAL SOFTWARE, crippled so it's nearly useless. MacUpdate should change the category of this software. 1/2 star for it's worth as TRIAL SOFTWARE. Don
Sep 10 2010
Sep 10 2010
Version: 4.1.5
Free? That's a bait.. Yea, you can use the free version for as long as you want, but it's not very useful in that capacity. Just call a spade a spade.. This is commercial software.
Jul 6 2010
Jul 6 2010
Version: 4.1.3
Wow. I'm really shocked by some of the reviews here. I've only started using Splunk in the last 6 months, so perhaps it's just improved rapidly. A couple of points here based on previous reviews: - Every report and graph I've generated so far, I've done in Safari 4 through 5 with no problems at all. Even so, if Splunk is what you need, you'll use whatever browser works. - Uninstall instructions were located by clicking the 'help' link at the upper right of the Splunk web interface. A search of the online docs produced this: http://www.splunk.com/base/Documentation/4.1.3/Installation/InstallonMacOS#Uninstall_Splunk Installation was very simple. Within minutes, the syslog data from my Firewall was streaming into the Splunk server. I wanted to use the default syslog port. Splunk's documentation provided the necessary extra steps to allow use of the lower port numbers (launch splunk with sudo). Anyone with a database mindset can easily craft a report and quickly locate and graph the desired log data. The interface offers several clues along the way as you work - very intuitive. Anyone can install Splunk for free and try it out. After a period of time, you lose some of the enterprise features and Splunk switches to the free version which you can use indefinitely. Bottom line, if you have syslog data to manage, you should try Splunk. There's nothing to lose, and so very much to gain. There's even an excellent online community that doesn't exclude free version users.
Apr 27 2009
Apr 27 2009
Version: 3.4.8
I just installed this, and then realised there is no directions on how to uninstall, the installer is very comprehensive, uninstall is not. Python based by the look of it and really for the geek user. I have spent a long time demythologising IT, I hate geek style stuff, packed with geek speak and terminal stuff when a simple gui would do. It only works in firefox If only spiceworks worked on mac
Nov 16 2007
Nov 16 2007
Version: 3.1.2
The system requirements on their web page indicate that this web-based engine does not work with Safari. Up till then, it looked pretty interesting.