failure installing 'Splunk for Xirrus Wireless Arrrays'

[lubahsplunk]

tried downloading the xirrus app successfully (splunk_xirrus_arrays.tar.gz) but when I to the splunk console | App | Manage Apps | Install App from file - then browse to the file and hit upload -- I receive the alert in red -- "there was an error processing the upload"

similarly, when I to the splunk console | App | Manage Apps | Find more apps online - search on xirrus then hit 'install free' the 'Splunk for Xirrus Wireless Arrays' app -- I receive ready to install screen -- hit install and then this alert in red appears --> "An error occurred while installing the app:500 - [HTTP 500] Application installation failed because: The archive does not contain an application subdirectory.."

ideas?

[lubahsplunk]

download was not corrupt but appears the way it was compressed with a splunk_xirrus_arrays directory within a splunk_xirrus_arrays directory is causing the issue.

I had to manually extract the .gz and .tar files and manually move the resulting splunk_xirrus_arrays directory to the installed drive /splunk /etc /apps location

restart splunk and it shows up!

[Michael_Wilde]

Likely a 7-zip issue. Did you by chance consider a direct install from Manager --> Apps --> Find apps? That seemed to work like a champ for me.

[lubahsplunk]

win2008ent 32 bit on a vm...

here's exactly what I experienced (as did a couple colleagues, too) when you download the app filename= splunk_xirrus_arrays.tar.gz (file size 57kb) from the app page and extract it manually (I tried with 7-zip and winzip) it extracts the file 'splunk_xirrus_arrays.tar' if you then extract that file it creates a directory named /splunk_xirrus_arrays and in it is another directory named /splunk_xirrus_arrays with all its subdirectories and files...

[Michael_Wilde]

Glad you got it installed. I'm sorry, but i'm not seeing the same behavior of a directory inside a directory in there. What platform are you running it on?

[Michael_Wilde]

Hi.. is it possible the download was corrupted? I just tried both a direct install from Splunk, and an "install by uploading a file" and it seemed to work fine.

Note. Once you get it installed, you may need to tune the "xirrus_events" eventtype if your data isn't sourcetyped "xirrus" or if its not directed to go in to "index=wireless" . Pretty easy to change.