The rpm and deb installers put the files in /opt/splunk. Ideally you'd move your existing installation aside, do a clean install via package, and then copy all of your local configuration (etc/system/local, etc/apps, etc/users, licenses, deployment manager files) into the new installation before starting Splunk. That way the package manager thinks it's a clean install rather than dealing with pre-existing/customized files.
