Hi gang,
I have been trying to install the newer Splunk App for Unix and Linux (5.0.0) on my Splunk recievers. I tried "upgrading" the Nix 4.6 and also tried to install it by itself. The download file from Splunk is a zip file, I was expecting a .tgz file. When I try to install or upgrade from the Splunk GUI, it just gives me a /etc ? app. This directory called etc does get loaded under /opt/splunk/etc/apps. I am not sure how to get this to work. I have NIX 4.6 working fine and have the Splunk_TA_nix running fine on my forwarders.
I am running Splunk 6.0 on my receivers and forwarders.
You need to extract the contents of the zip. You cant install it directly or you will see the /etc app listed.
The instructions are listed here
http://docs.splunk.com/Documentation/UnixApp/5.0/User/InstalltheSplunkAppforUnixandLinux
I have had the same problem.
Turns out: The Splunk for *NIX app version 5.0.0 is broken.
The fix is to install version 5.0.1 -- You may have to manually delete the "...etc/apps/etc" folder.
I realize this is an old posting, but still want to point out the problem with 5.0.0.
You need to extract the contents of the zip. You cant install it directly or you will see the /etc app listed.
The instructions are listed here
http://docs.splunk.com/Documentation/UnixApp/5.0/User/InstalltheSplunkAppforUnixandLinux