Supportability of Amazon Linux 2023 (AL2023) with Splunk Enterprise
Available Languages
Applicability
Splunk Enterprise Core On-Premise Universal ForwarderDescription
Questions about AL2023 and want to ensure when you upgrade to AL2023 AMI, Splunk Enterprise will download as expected. Documentation shows 9.1.5 currently supports Linux Kernel 5.x and higher. Since AL2023 is Kernel 6.x, will the packages work as expected?
Resolution
At this time, there is not a white paper specifically addressing Splunk's support for Amazon Linux 2023.
Thus, Splunk documentations is referenced when understanding what OS is supported by checking on the list of system requirements dependent on your Splunk deployment, instance, or component.
The Universal Forwarder package does support both Linux 6.x kernel for 86x64 & ARM architectures. However, for Splunk Enterprise core on-premises deployment, the system requirements according to Splunk docs shows that Linux kernel 6.x is not yet supported on Splunk 9.1.5 as well up thru the current latest version of 9.3.1.
The Universal Forwarder package does support both Linux 6.x kernel for 86x64 & ARM architectures. However, for Splunk Enterprise core on-premises deployment, the system requirements according to Splunk docs shows that Linux kernel 6.x is not yet supported on Splunk 9.1.5 as well up thru the current latest version of 9.3.1.
Although in Splunk Enterprise 9.1.5, documentation shows support for Linux kernel versions 5.4 and higher; as seen in the docs, on-premise core supports Linux kernels 5.4.x, 5.10, 5.14, and 5.15, it does not, however, support Linux kernels 6.x for AL2023 at this time.
Referencing Splunk Documentation:
Referencing Splunk Documentation:
System requirements for use of Splunk Enterprise on-premises version 9.1.5
And depending on the Splunk components, such as Data Stream Processor which currently does support Amazon Linux 2 among other Linux distributions, but not AL2023.
And depending on the Splunk components, such as Data Stream Processor which currently does support Amazon Linux 2 among other Linux distributions, but not AL2023.
Also, the Workload Management follows the Splunk Enterprise core on-premises requirements:
However, for Splunk Observability Cloud the Collector supports Linux distributions for Amazon Linux: 2 and 2023.
System requirements for Splunk Observability Cloud
Related Links
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
29-Sep-2026
|
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)