Install Splunk apps
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Install Splunk apps
This topic discusses the ways you can download and install applications from SplunkBase. SplunkBase is the repository for all apps created by Splunk and the Splunk community. You can either access applications directly from SplunkBase or you can use Splunk's App manager.
Read the About Apps topic for general information. For information about specific Splunk applications and building your own application, refer to the Apps Wiki.
via Splunk's App Manager
Splunk Web's Admin interface includes an [URL app manager], the Applications page. You can use this page to view and manage all your existing applications and browse SplunkBase for more applications. The Applications: Browse SplunkBase page lets you view and install any of the applications available on SplunkBase.
To install an application using Splunk Web:
1. From the Admin > Applications page, click Browse SplunkBase.
2. Scroll through the list of applications to find the one you want.
You can use the category links to narrow your search. Each application listed include a brief summary and some statistics, such as last update, number of downloads, and price.
Note: For more information about an application, click its name to open its SplunkBase page in another window or tab. If you want to install the application, return to Splunk Web before continuing.
3. Each application has an install button: Install Free for free applications or Install 30-day Free Trial for applications that have an associated price. Click the install button.
Splunk Web redirects you to a SplunkBase login page.
4. Use your Splunk.com username and password to log into SplunkBase.
After you click Login, Splunk downloads and installs the application and redirects you to the Applications: View/Manage Applications page. You should now see the new application in the list.
5. To complete the installation process, restart Splunk.
You can restart Splunk from the Admin > Server: Control Server page. Just click Restart Now.
after download from SplunkBase
1. Download your application from SplunkBase.
Note: Apps come packaged with the Splunk extension .spl.
2. Rename the SPL file to replace the .spl extension with .tar.gz.
For example, if you downloaded myApp.spl, rename it myApp.tar.gz.
3. Move and expand the application file into the $SPLUNK_HOME/etc/apps/ directory.
4. Review the contents of the application.
You may need to configure the app before you continue. For more information, refer to Configuring your new application.
5. After you configure the application, restart your Splunk server.
From the CLI, you can restart Splunk with:
./splunk restart
The application is now installed and can be viewed and managed from Splunk's App manager.
on an isolated network or machine
If your Splunk server cannot reach the WAN, Splunk Web will not be able to access SplunkBase. To install an application in this situation, download the app using another machine that can access the WAN. Then, transfer the file to the desired machine and expand the file into the proper directory to install the application.
1. From a machine that can access the WAN, download an application from SplunkBase.
2. Rename the SPL file to replace the .spl extension with .tar.gz.
3. Transfer the file to the $SPLUNK_HOME/etc/apps/ directory on the desired machine.
Note: Depending on the accessibility of this isolated machine, this may require SCP/FTP or a USB drive.
4. Expand the application file into the $SPLUNK_HOME/etc/apps/ directory.
6. Restart your Splunk server.
Enable app via CLI
To enable a Splunk application via the CLI, you must first download the applicaton from SplunkBase and unpack it as directed above:
./splunk enable app <appname> -auth <username>:<password>
Note: If you are running Splunk with a free license, you do not have to provide a username and password.
Disable app via CLI
To disable a Splunk application via the CLI:
./splunk disable app <appname> -auth <username>:<password>
Note: If you are running Splunk with a free license, you do not have to provide a username and password.
This documentation applies to the following versions of Splunk: 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.