Splunk
Splunk
6.3.0

5.0

Splunk free download for Mac

Splunk

6.3.0
28 September 2015

Indexes logs from any source.

Overview

Note: Splunk is available in a limited free version, a cloud version, and an enterprise version. Contact a sales representative for pricing info.

Splunk Server indexes logs from ANY source (apache, OS X, sendmail, routers). No need to configure it for specific formats, write regular expressions, or change your logging output.

Search mountains of data by time, keywords, type of event, source, host, or relationships to other events. Note: Splunk is server software. You configure and use the software via a Web browser.

What's new in Splunk

Version 6.3.0:

Note: Now requires OS X 10.9 or later.

New
Platform
  • Search Parallelization. Optimized CPU utilization for faster search execution. See "Manage report acceleration", "Accelerate data models", and "Configure batch mode search" in the Knowledge Manager Manual.
  • Index Parallelization. Optimized CPU utilization for faster data ingestion.
  • Intelligent Job Scheduling. Intelligent job scheduling provides improved system utilization and predictable performance. See "Configure the priority of scheduled reports" in the Reporting Manual.
  • Data Integrity Control. Data integrity control ensures that indexed data has not been modified. See "Manage data integrity" in the Securing Splunk Enterprise manual.
  • Single Sign-On Using SAML. Support for SAML 2.0 for single sign-on using PingFederate as the Identity Provider. See "About single sign-on using SAML" in the Securing Splunk Enterprise manual.
  • Search Head Clustering Improvements. Performance optimization, scalability, and management improvements. Support for Windows OS.
  • Indexer Clustering Improvements. Ability to turn off search affinity. See "Implement search affinity in a multisite indexer cluster" in the Managing Indexers and Clusters of Indexers manual.
  • HTTP Event Collector. Indexing of high-volume JSON-based application and IOT data sent directly via a secure, scalable HTTP endpoint. No Forwarder required. See "Use the HTTP Event Collector" in the Getting Data In manual.
  • Custom Alert Actions. Customizable alert actions and packaged integrations with popular third-party applications or messaging systems. See "Custom alert actions overview" in the Developing Views and Apps for Splunk Web manual.
  • Key Value Store - Distributed Lookups. Allows App developers to do KV Store lookups on remote indexers to improve efficiency in large scale distributed environments. See "About the app key value store" in the Admin Manual.
  • Key Value Store - Lookup Filtering. Allows App developers to filter lookup data without requiring subsequent searches. See "About the app key value store" in the Admin Manual.
Management and Administration
  • HTTP Event Collector Configuration. Create and manage configurations for the HTTP Event Collector. See "Use the HTTP Event Collector" in the Getting Data In manual.
  • Source Type Manager. Create and manage source type configurations independent of getting data in, and search within the source type picker. See "Manage source types" in the Getting Data In manual.
  • Powershell Input. Native support for ingesting data retrieved by Powershell scripts. See the Splunk Add-on for Microsoft PowerShell manual.
  • App Browsing Interface. Automates and simplifies app and add-on discovery within Splunk Web.
  • Indexer Auto-Discovery. Forwarders now dynamically retrieve indexer lists from cluster master to enable elastic deployments. See "Use indexer discovery to connect forwarders to peer nodes" in the Managing Indexers and Clusters of Indexers manual.
  • Distributed Management Console. New topology views, status, and alerting for Splunk platform deployments including: indexers, search heads, forwarders, and storage utilization. See "About the distributed management console" in the Distributed Management Console Manual.
  • Field Extractor Enhancements. Simplified field extraction via delimiter and header selection. Displays field extractions within the event preview. See "Build field extractions with the field extractor" in the Knowledge Manager Manual.
  • Search Process Memory Usage Threshold. New configuration parameters to specify the maximum physical memory usage that a single search process can consume. See the search_process_memory_usage_threshold and search_process_memory_usage_percentage_threshold stanzas in "limits.conf" in the Admin Manual.
Usability
  • Single Value Display. Support for at-a-glance, single-value indicators with historical context and change indicators. See the "Single value visualizations" section of "Visualization Reference" in the Dashboards and Visualizations manual.
  • Geospatial Visualization. Support for choropleth maps to visualize how a metric varies across a customizable geographic area. See "Mapping data" in the Dashboards and Visualizations manual.
  • Dashboard Enhancements. More powerful dashboards with extended search and token management. See "Token usage in dashboards" in the Dashboards and Visualizations manual.
  • Search History. View and interact with ad-hoc search command history. See "View and interact with your Search History" in the Search Manual.
  • Anomaly Detection. New SPL command that offers histogram based approach for detecting anomalies. Also includes the capabilities of existing anomalousvalue and outlier SPL commands. See "anomalydetection" in the Search Reference manual.
  • Search Helper Improvements. Re-architected to improve responsiveness.
Developer
  • Java logger Support for HTTP Event Collector. Adds support for log4j, logback and java.util.logging to allow logging from Java apps over HTTP.
  • .NET Logger support for HTTP Event Logger. Adds support for the .NET Trace Listener API and SLAB (Semantic Logging Application Block) to allow logging from apps over HTTP.
  • Custom Alert Actions. Allows developers to build, package, and integrate custom alert actions as native to Splunk software. See "Custom alert actions overview" in the Developing Views and Apps for Splunk Web manual.
  • Key Value Store - Distributed Lookups. Allows App developers to do KV Store lookups on remote indexers to improve efficiency in large scale distributed environments. See "About the app key value store" in the Admin Manual.
  • Key Value Store - Lookup Filtering. Allows App developers to filter lookup data without requiring subsequent searches. See "About the app key value store" in the Admin Manual.
Documentation
  • The Distributed Management Console Manual provides dedicated information on the distributed management console that was introduced in Splunk Enterprise 6.2.
  • The Distributed Deployment Manual has been substantially expanded to provide enhanced guidance on implementing, maintaining, and expanding a distributed deployment. In particular, it now features a set of end-to-end implementation frameworks for common deployment scenarios.
  • The Getting Data In manual has been reorganized to provide faster access to the information you need to get your data into Splunk Enterprise. The manual includes information on updated features, and content within the book has been reorganized to make procedures easier to understand and follow.
  • The Forwarding Data manual has been updated to make the installation instructions for the universal forwarder more accessible, and to better group and clarify universal forwarder concepts and activities in deployments of the Splunk platform.
New REST APIs
  • data/inputs/http
  • data/inputs/http/{name}
  • data/inputs/http/{name}/disable
  • data/inputs/http/{name}/enable
  • licenser/usage
  • services/collector/event
  • services/collector/mint
  • services/data/ui/alerts
  • servicesNS/{user}/{app}/data/ui/alerts
  • services/server/introspection/search/dispatch/Bundle_Directory_Reaper
  • services/server/introspection/search/dispatch/Dispatch_Directory_Reaper
  • services/server/introspection/search/dispatch/Search_StartUp_Time
  • services/server/introspection/search/distributed
  • services/server/introspection/search/saved
  • services/search/scheduler
  • services/search/scheduler/scheduler

View the complete release notes.

6 Splunk Reviews

Rate this app:

Lylehm
06 July 2010

Most helpful

Wow. I'm really shocked by some of the reviews here. I've only started using Splunk in the last 6 months, so perhaps it's just improved rapidly. A couple of points here based on previous reviews: - Every report and graph I've generated so far, I've done in Safari 4 through 5 with no problems at all. Even so, if Splunk is what you need, you'll use whatever browser works. - Uninstall instructions were located by clicking the 'help' link at the upper right of the Splunk web interface. A search of the online docs produced this: http://www.splunk.com/base/Documentation/4.1.3/Installation/InstallonMacOS#Uninstall_Splunk Installation was very simple. Within minutes, the syslog data from my Firewall was streaming into the Splunk server. I wanted to use the default syslog port. Splunk's documentation provided the necessary extra steps to allow use of the lower port numbers (launch splunk with sudo). Anyone with a database mindset can easily craft a report and quickly locate and graph the desired log data. The interface offers several clues along the way as you work - very intuitive. Anyone can install Splunk for free and try it out. After a period of time, you lose some of the enterprise features and Splunk switches to the free version which you can use indefinitely. Bottom line, if you have syslog data to manage, you should try Splunk. There's nothing to lose, and so very much to gain. There's even an excellent online community that doesn't exclude free version users.
Like (2)
Version 4.1.3
Jazzyguy
25 February 2014
Works Great on Mavericks.
Like (1)
Version 6.0.2
Donmontalvo
31 May 2013
Wow @Mutant is right...this is NOT FREE. More like TRIAL SOFTWARE, crippled so it's nearly useless. MacUpdate should change the category of this software. 1/2 star for it's worth as TRIAL SOFTWARE. Don
Like
Version 5.0.3
1 answer(s)
Regular-Warren
Regular-Warren
31 May 2013
Donmontalvo, Sorry for the confusion. I can't find a perfect way to list this app. The developer offers a "free" (limited) version and an "enterprise" version. Pricing information is absent from their site, and users are encouraged to contact a sales representative. I've added a note to the top of our listing.
Like (1)
Mutant
10 September 2010
Free? That's a bait.. Yea, you can use the free version for as long as you want, but it's not very useful in that capacity. Just call a spade a spade.. This is commercial software.
Like (2)
Version 4.1.5
Lylehm
06 July 2010
Wow. I'm really shocked by some of the reviews here. I've only started using Splunk in the last 6 months, so perhaps it's just improved rapidly. A couple of points here based on previous reviews: - Every report and graph I've generated so far, I've done in Safari 4 through 5 with no problems at all. Even so, if Splunk is what you need, you'll use whatever browser works. - Uninstall instructions were located by clicking the 'help' link at the upper right of the Splunk web interface. A search of the online docs produced this: http://www.splunk.com/base/Documentation/4.1.3/Installation/InstallonMacOS#Uninstall_Splunk Installation was very simple. Within minutes, the syslog data from my Firewall was streaming into the Splunk server. I wanted to use the default syslog port. Splunk's documentation provided the necessary extra steps to allow use of the lower port numbers (launch splunk with sudo). Anyone with a database mindset can easily craft a report and quickly locate and graph the desired log data. The interface offers several clues along the way as you work - very intuitive. Anyone can install Splunk for free and try it out. After a period of time, you lose some of the enterprise features and Splunk switches to the free version which you can use indefinitely. Bottom line, if you have syslog data to manage, you should try Splunk. There's nothing to lose, and so very much to gain. There's even an excellent online community that doesn't exclude free version users.
Like (2)
Version 4.1.3
misterjspencer
27 April 2009
I just installed this, and then realised there is no directions on how to uninstall, the installer is very comprehensive, uninstall is not. Python based by the look of it and really for the geek user. I have spent a long time demythologising IT, I hate geek style stuff, packed with geek speak and terminal stuff when a simple gui would do. It only works in firefox If only spiceworks worked on mac
Like (1)
Version 3.4.8
Alrescha
16 November 2007
The system requirements on their web page indicate that this web-based engine does not work with Safari. Up till then, it looked pretty interesting.
Like
Version 3.1.2
18 answer(s)
sjk
sjk
29 November 2007
Yeah, lack of Safari support killed my interest in Splunk.
Like (1)
Version 3.1.3
sjk
sjk
23 May 2008
What a daft comment. Some of us consciously prefer Safari to Firefox; read http://daringfireball.net/2008/04/firefox_3_safari_3 for some reasons why.
Like (6)
Version 3.2.4
Mikaelf
Mikaelf
17 June 2008
Hey kids! You know you can use both...right? /Mikael
Like (1)
Version 3.2.6
Mondele
Mondele
01 July 2008
I happen to be someone who typically has a dozen browsers on my machine, but I do agree that to require a non-Safari browser for a piece of software will limit its acceptability. Web standards are there for a reason, and to make a web-based interface that won't work with a standards-compliant browser is, IMHO, shortsighted.
Like
Version 3.3
Dalahast
Dalahast
31 July 2008
Ugh, Firefox is waaaay slow, even Mac-optimised builds like Minefield. No Safari support means less users.
Like (1)
Version 3.3.1
Mikaelf
Mikaelf
31 July 2008
Firefox is 3.0.1 is not slow and is the more compliant browser on the web and it exists on all platforms. Obvious target for any smart web developer. Splunk's mac customers is probably less than %1. Look at what they do and there reference customers. How many of those do you think run Mac OS X server...I would say very very few.... /Mikael
Like
Version 3.3.1
Dalahast
Dalahast
31 July 2008
Safari's fine by me and, after previous experiences with FF, I don't have any plans to switch.
Like
Version 3.3.1
Dalahast
Dalahast
31 July 2008
And might I add that web development is a hobby of mine.
Like
Version 3.3.1
Mikaelf
Mikaelf
31 July 2008
and IT is my profession since -90.... /Mikael
Like
Version 3.3.1
Dalahast
Dalahast
31 July 2008
Safari didn't even exist then.
Like
Version 3.3.1
Mikaelf
Mikaelf
31 July 2008
Seriously...it didn't? I thought the internet was there...like..always. The browser and the web apps is nothing but the "emperors new clothes" for an old block mode terminal. Only in the last couple years have AJAX technology spiced it up a bit but the principles are still the same. Text strings back and forth over a stateless transport protocol (http). /Mikael
Like
Version 3.3.1
Dalahast
Dalahast
31 July 2008
Firefox doesn't support CSS3 from what their official website says. Safari does.
Like
Version 3.3.1
Mikaelf
Mikaelf
31 July 2008
Now you're being silly. There are far more websites that recognizes Firefox than there are Safari compliant ones. I never said I didn't like Safari, it is my default browser on my Mac. Firefox is the default on my Windows and Linux environments. I'm just more pragmatic...if Safari doesn't work on a website I'm visiting and I'm on my mac...I start Firefox. Big deal. Now, go get yourself a job.... /Mikael
Like
Version 3.3.1
Dalahast
Dalahast
31 July 2008
I'm 13. How am I supposed to do that?
Like
Version 3.3.1
Mondele
Mondele
31 July 2008
Mikael, I think what you are missing is that if Splunk were written in a standards-compliant way, it would work with Safari. I don't know of any deficiencies of Safari that would keep it from working with the kind of behavior we are looking for from Splunk. As I mentioned, I tend to use a lot of different browsers, and I use the one that I think will work best for a particular purpose. I do tend to use FireFox for web development because of the plugins that expand capabilities in that regard, but Safari is a fine browser, and many people will feel that it is the only one they need. If Splunk will not run with Safari, it is a valid comment to say that it is therefore a non-starter. Splunk may run fine on Linux and Windows, and on the Mac with FireFox, but this is MacUpdate, and the Mac users here have a legitimate concern if it doesn't function with the default Mac browser - the one with which, presumably, they are downloading Splunk. Telling people that they are silly for their software choices is a uniquely unhelpful means of persuasion.
Like (3)
Version 3.3.1
sjk
sjk
31 July 2008
Well said, mondele.
Like (1)
Version 3.3.1
Mikaelf
Mikaelf
31 July 2008
My god... I didn't say anyone was silly because of what software they were using. Then I would be silly too since Safari is my default browser...did you READ my comment? I thought the line of arguments was silly... Why Splunk doesn't work with Safari is probably because it's heavy usage of AJAX technology and frankly, there aren't enough demand. It's simple, no development org have unlimited resources so you prioritize and if there isn't a business case...why waste resources? If/when enough of Splunks customers complain and they lose deals...there will be Safari support, I'm sure. /Mikael
Like
Version 3.3.1
VRH
VRH
21 February 2009
I use Splunk with Safari all the time and it works fine. They just don't support it "officially," but it works. There are a couple display related annoyances under Safari, but nothing intolerable. Those annoyances are not present when using Firefox.
Like (1)
Version 3.4.6
Free

5.0

App requirements: 
  • Intel 64
  • OS X 10.9.0 or later
Category: 
Developer Website: 
Download(139.6 MB)MacUpdateInstall with MacUpdate

Downloaded & Installed 17,350 times