Part of the problem I see is that you're not creating the tos app correctly. .conf files need to go into a local/ or default/ directory and there's no need to create a tos.conf.
On a Search Head Cluster Deployer:
mkdir -p etc/shcluster/apps/tos/{default,metadata}
cd etc/shcluster/apps/tos/default
On a single instance:
mkdir -p etc/apps/tos/{default,metadata}
cd etc/apps/tos/default
Create web.conf (yes, you can and should create this file in the tos app. No need to go mucking about in etc/system/local/)
vim web.conf
Add the following two lines
[settings]
termsOfServiceDirectory = $SPLUNK_HOME/etc/apps/tos/default
Create 1.html (also in the tos/default/ directory)
vim 1.html
1.html example contents:
<p>These are the terms of service.</p>
Then restart Splunk. If you're on a SHC, initiate a rolling restart. After the restart completes, you will see the TOS after logging in.
I have tested this on a 7.3.4 SHC with SSO/SAML and a single instance 8.0.2.1 with normal Splunk authentication.
... View more