All Apps and Add-ons

Extract .spl file from Splunk v4.1.2

Pete_Bassill
Path Finder

Hi

I need to extract a splunk app file (.spl) created in v4.1.2 onto a non splunk machine (linux workstation) to carry out some debugging of an app. I have tried renaming the app name.tar.gz from name.spl but I get the following error:

gzip: name.tar.gz: not in gzip format tar: This does not look like a tar archive tar: -: Not found in archive tar: Exiting with failure status due to previous errors

Anyone have any ideas?


Ok, so the plot thickens. A fresh extract of the app from my 4.1.2 splunk server using ./splunk package app pci gives me the correct pci.spl file but when I try to re-import, it get the error: Failed to extract files from Application - Is it in tar.gz format?

Weird? Possible bug in 4.1.2?

Ta

Tags (1)
0 Karma

Lowell
Super Champion

Are you sure that your file is gziped? I find the unix file utility very helpful for these types of things. Try file app.spl

0 Karma

Mick
Splunk Employee
Splunk Employee

If you just rename the .spl file to .tar it you should be able to un-tar it as normal. I'm not sure if this will work without renaming it, give that the file itself is still the same, I would think it should.

It's possible that ./splunk packagecommand compresses it, although the message output suggests that it shouldn't.

To get the app over from one machine to the other, it might be easier just to manually create a .tar file and copy over.

Lowell
Super Champion

See this answer:


I see you pretty new to the answers.splunk.com site, so here is a hint. Check out the related questions on the right-side of the screen. A number of them look applicable to your question.

Nicholas_Key
Splunk Employee
Splunk Employee

can you please provide the name of the app?
Is it the pci app?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...