If you are using sparse zones, and you are using the solaris package format, you will have to do the package add in the global zone.
I'm not sure that's correct; I'm using a sparse zone and the package installed directly into the child zone just fine.
However, if you want splunk installed in the global zone and in a child zone (for instance, we run the *NIX app and a forwarder on all of our boxes' global zones, whilst the indexer and splunkweb run in a single child), then be very careful when upgrading the global zone, since you'll have to do pkgrm to remove the old package first, and there's (AFAIK) no way to do pkgrm on the global zone without it cascading to child zone and removing that package too.
... View more