Hello all,
I am very new to Splunk. I am using Splunk Light and trying to use the Splunk for Snort app alongside a project I am working on. I was confused how to execute the step "extract the .spl file in $SPLUNK_HOME/etc/apps", so I extracted the downloaded file onto my desktop using 7z. Once extracted, I took that file and moved it into the specified directory in apps ($SPLUNK_HOME/etc/app). My reason for this question is that when I tried to extract directly, permission was denied. I am using Windows. Will this process suffice?
Thank You
Files ending in .spl are just tgz (tarred gzip files).
Apps are containing in their own subdirectory of etc/apps, so assuming your files are in etc/apps/splunk_snort (or whatever the Snort app calls itself) you should be good after a restart.
Also, double check that the files are all owned by the proper user.
I've not used Splunk Light, but the Enterprise version allows you to install that spl file via the GUI and it will untar/gunzip it into the correct location with perms for you. In the Enterprise version, it is the top left corner, click on Apps dropdown, then Manage Apps. You should have a button there to install from file.
I went ahead and tried your method along with the above answer, both worked! Thank You
Files ending in .spl are just tgz (tarred gzip files).
Apps are containing in their own subdirectory of etc/apps, so assuming your files are in etc/apps/splunk_snort (or whatever the Snort app calls itself) you should be good after a restart.
Also, double check that the files are all owned by the proper user.