Splunk Search

spl2 module upload successful, and testing is also successful but it's nowhere to be found.

kundeng
Path Finder

Am I missing something?  

I have vscode running splunk extension and created a simple _default.spl2nb.  

I'm able to testing it and getting results back, and uploading to the search app or a custom app spl2-test also gives me success message. 

But when I go to the splunk deployment <app>/default/data.  I don't see spl2 folder at all. 

What's going on?  Thanks. 


Labels (1)
Tags (1)
0 Karma

kundeng
Path Finder

I don't know why I have to run the following, and the spl2 file shows up.  

~/splunk/bin/splunk download-spl2-modules app spl2-test -dest default

 But still, I am getting error when I try to run

|@spl2 from search1



Error in 'SearchParser': The SPL2 query is invalid: 'unknown error: Unable to fetch roles for the user'.
0 Karma

kundeng
Path Finder

I will answer my own question:
* spl2 currently still uses kv-store and file sync implementation is neither complete nor fully functional as of today. 
* one needs to apply enterprise license for spl2 to be enabled. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...