All Apps and Add-ons

Splunk for Snort: How to "extract the .spl file in $SPLUNK_HOME/etc/apps"?

patelaj94
New Member

Hello all,

I am very new to Splunk. I am using Splunk Light and trying to use the Splunk for Snort app alongside a project I am working on. I was confused how to execute the step "extract the .spl file in $SPLUNK_HOME/etc/apps", so I extracted the downloaded file onto my desktop using 7z. Once extracted, I took that file and moved it into the specified directory in apps ($SPLUNK_HOME/etc/app). My reason for this question is that when I tried to extract directly, permission was denied. I am using Windows. Will this process suffice?

Thank You

0 Karma
1 Solution

ckurtz
Path Finder

Files ending in .spl are just tgz (tarred gzip files).

Apps are containing in their own subdirectory of etc/apps, so assuming your files are in etc/apps/splunk_snort (or whatever the Snort app calls itself) you should be good after a restart.

Also, double check that the files are all owned by the proper user.

View solution in original post

jeremiahc4
Builder

I've not used Splunk Light, but the Enterprise version allows you to install that spl file via the GUI and it will untar/gunzip it into the correct location with perms for you. In the Enterprise version, it is the top left corner, click on Apps dropdown, then Manage Apps. You should have a button there to install from file.

patelaj94
New Member

I went ahead and tried your method along with the above answer, both worked! Thank You

0 Karma

ckurtz
Path Finder

Files ending in .spl are just tgz (tarred gzip files).

Apps are containing in their own subdirectory of etc/apps, so assuming your files are in etc/apps/splunk_snort (or whatever the Snort app calls itself) you should be good after a restart.

Also, double check that the files are all owned by the proper user.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...