Splunk for Snort: How to "extract the .spl file in $SPLUNK_HOME/etc/apps"?

[patelaj94]

Hello all,

I am very new to Splunk. I am using Splunk Light and trying to use the Splunk for Snort app alongside a project I am working on. I was confused how to execute the step "extract the .spl file in $SPLUNK_HOME/etc/apps", so I extracted the downloaded file onto my desktop using 7z. Once extracted, I took that file and moved it into the specified directory in apps ($SPLUNK_HOME/etc/app). My reason for this question is that when I tried to extract directly, permission was denied. I am using Windows. Will this process suffice?

Thank You

[jeremiahc4]

I've not used Splunk Light, but the Enterprise version allows you to install that spl file via the GUI and it will untar/gunzip it into the correct location with perms for you. In the Enterprise version, it is the top left corner, click on Apps dropdown, then Manage Apps. You should have a button there to install from file.

[patelaj94]

I went ahead and tried your method along with the above answer, both worked! Thank You

[ckurtz · Accepted solution]

Files ending in .spl are just tgz (tarred gzip files).

Apps are containing in their own subdirectory of etc/apps, so assuming your files are in etc/apps/splunk_snort (or whatever the Snort app calls itself) you should be good after a restart.

Also, double check that the files are all owned by the proper user.