Hello,
I am trying to manually import the .spl file of a Splunk addon called 'Windows Event Log Analysis', the file has been provided on the EventID website here: http://www.eventid . net/splunk_addon.asp
I also tried downloading the addon from the Splunkbase, this provides me with a .tgz file that contains quite a bigger amount of files.
This download can be found here: https://splunkbase.splunk.com/app/3067/
My question is, how would I import either of these files into my Splunk installation on Linux (Ubuntu 16.04) ?
The reason I am trying to import the addon manually is that for some reason the Splunk Apps browser refuses my Splunk credentials, when a regular login to the Splunk.com with the same credentials does actually work.
Thank you 🙂
The answer looks like this (inside a docker container running the free enterprise version)
sudo -u splunk /opt/splunk/bin/splunk install app ./splunk-machine-learning-toolkit_500.tgz -update 1
See
$ splunk help install
@helpdeskrtvnoord, if you have downloaded .tgz
file you can use Install App From File
option to install the App/Add On. Directly browsing to Splunkbase for installation might be blocked at enterprise level. Have you tried Install App from File option?