Use Cases downloaded from Splunk with .spl file extension

[FAnalyst]

Hello,

I have downloaded all the Use Cases in ES app and now I want to open .spl file to look into these Use Cases but do not want to upload the file as an app 

[inventsekar]

Hi @FAnalyst 

>>>now I want to open .spl file to look into these Use Cases

Yes, as said on above two replies, you can untar the file (.spl = tar file) and look into it, check the contents, try to understand the searches, etc

>>>but do not want to upload the file as an app 
Yes, you no need to upload it to Splunk. 

i feel you want to edit some usecase and then upload then tar it as a .spl file(tar file) and then upload it to Splunk. it is also possible. careful while editing(pls preserve the format), all should be good, thanks. 

Best Regards

Sekar 

[gcusello]

Hi @FAnalyst ,

as also @PickleRick said, spl is a tar.gz file tat you can open with a tool like 7zip and then search the savedsearches.conf file, in which you can find the Correlations searches, but what's your requirement?

Ciao.

Giuseppe

[PickleRick]

And where is the question?

But seriously - .spl file is just a tar.gz archive.