I need to extract a splunk app file (.spl) created in v4.1.2 onto a non splunk machine (linux workstation) to carry out some debugging of an app. I have tried renaming the app name.tar.gz from name.spl but I get the following error:
gzip: name.tar.gz: not in gzip format
tar: This does not look like a tar archive
tar: -: Not found in archive
tar: Exiting with failure status due to previous errors
Anyone have any ideas?
Ok, so the plot thickens. A fresh extract of the app from my 4.1.2 splunk server using ./splunk package app pci gives me the correct pci.spl file but when I try to re-import, it get the error: Failed to extract files from Application - Is it in tar.gz format?
If you just rename the .spl file to .tar it you should be able to un-tar it as normal. I'm not sure if this will work without renaming it, give that the file itself is still the same, I would think it should.
It's possible that ./splunk packagecommand compresses it, although the message output suggests that it shouldn't.
To get the app over from one machine to the other, it might be easier just to manually create a .tar file and copy over.