App Removal ?

[harry_hodge]

I could not get the *nix to update from 4.6 to 5.0. I removed ($SPLUNK_HOME/etc/apps and $SPLUNK_HOME/etc/users) and restarted splunk.

Now when I go to install *nix I get "App with this name already exists."
What am I missing?

[malmoore]

There is no direct upgrade path from version 4.6 of the Unix App to version 5.0. You should not attempt to install version 5.0 over 4.6.

You can run both version 4.6 and 5.0 at the same time; Version 5.0 can be configured to read the data that Version 4.6 stored.

How do I upgrade from a previous version?

[harry_hodge]

I had installed both. Problem was I also un-installed both and could not get 5.0 to re-install/upgrade. It thought it was already there even though the files and directories were missing. Thanks for the comment.

[grijhwani · Accepted solution]

It might be a bogus error message. Bear in mind that by default Splunk installs the apps directory with its default set of apps, and it may be failing to create the app-specific directory because the base directory is missing, but reporting that failure as the directory already existing (which would cause a superficially similar failure to create).

Perhaps you should reinstate the empty directory. (You would hope that Splunk would be smart enough to create it automatically, and it seems like a huge oversight, but you never know and it is the first thing I would try.)

[harry_hodge]

Good Catch. I ended up recreating the directory and manually extracting the files. Working like a champ now. Thanks,
Harry

[lukejadamec]

Not sure where Splunk in storing it, but these things might work for you:

From Manage Apps, check for the nix App and disable it if it is there.

From Manager Apps Upload App, select the Upgrade App check box.

Often times I find the app needs to be disabled before it can be upgraded.

[harry_hodge]

Problem is I can no longer see the app from any of these screens.