|
Hi I need to extract a splunk app file (.spl) created in v4.1.2 onto a non splunk machine (linux workstation) to carry out some debugging of an app. I have tried renaming the app name.tar.gz from name.spl but I get the following error: gzip: name.tar.gz: not in gzip format tar: This does not look like a tar archive tar: -: Not found in archive tar: Exiting with failure status due to previous errors Anyone have any ideas? Ok, so the plot thickens. A fresh extract of the app from my 4.1.2 splunk server using ./splunk package app pci gives me the correct pci.spl file but when I try to re-import, it get the error: Failed to extract files from Application - Is it in tar.gz format? Weird? Possible bug in 4.1.2? Ta |
|
See this answer: I see you pretty new to the answers.splunk.com site, so here is a hint. Check out the related questions on the right-side of the screen. A number of them look applicable to your question. |
|
If you just rename the .spl file to .tar it you should be able to un-tar it as normal. I'm not sure if this will work without renaming it, give that the file itself is still the same, I would think it should. It's possible that To get the app over from one machine to the other, it might be easier just to manually create a .tar file and copy over. |
can you please provide the name of the app? Is it the pci app?
Are you sure that your file is gziped? I find the unix
fileutility very helpful for these types of things. Tryfile app.spl