topic Re: Uninstall Splunk on Linux in Deployment Architecture

Uninstall Splunk on Linux

Bill_B — Mon, 28 Sep 2020 16:48:20 GMT

In the guide for uninstalling Splunk from Linux, it says; "rpm -e splunk_product_name".
What is meant by, "splunk_product_name"? Is that the name of the installed file?
I installed using the wget URL. So would the command be, "rpm -e splunk-6.1.1-207789-Linux-x86_64.tgz"?
Also, what directory should this command be executed from?

-Thank you

Re: Uninstall Splunk on Linux

richgalloway — Thu, 05 Jun 2014 19:16:54 GMT

Run the following command to find the correct package name.

rpm -q -a | grep -i splunk

Pass the result to the rpm -e command.

Re: Uninstall Splunk on Linux

Bill_B — Thu, 05 Jun 2014 19:31:10 GMT

If the above command returns no result then a manual uninstall must done. Yes?

Re: Uninstall Splunk on Linux

richgalloway — Thu, 05 Jun 2014 20:06:54 GMT

If you get no results from the rpm command then it probably means Splunk was not installed using rpm. You would then need to uninstall it manually.

Re: Uninstall Splunk on Linux

SantoshBansode — Tue, 29 Sep 2020 09:38:07 GMT

rpm -qa | grep -i splunk
Then put the command rpm -e above_command_result
Example : rpm -e splunkforwarder-6.3.2-aaff59bb082c.x86_64

Re: Uninstall Splunk on Linux

mhouse3 — Wed, 30 Sep 2020 04:15:49 GMT

It does not work for me. When I run it I get a bunch of errors and the /opt/splunk/ path is still there:

warning: file /opt/splunk/share/splunk/search_mrsparkle/modules.new/messaging/Message.conf: remove failed: No such file or directory
warning: file /opt/splunk/share/splunk/search_mrsparkle/modules.new/messaging: remove failed: No such file or directory
warning: file /opt/splunk/share/splunk/search_mrsparkle/modules.new/DispatchingModule.js: remove failed: No such file or directory
warning: file /opt/splunk/share/splunk/search_mrsparkle/modules.new/DispatchingModule.conf: remove failed: No such file or directory
warning: file /opt/splunk/share/splunk/search_mrsparkle/modules.new/AbstractModule.js: remove failed: No such file or directory
warning: file /opt/splunk/share/splunk/search_mrsparkle/modules.new/AbstractModule.conf: remove failed: No such file or directory
warning: file /opt/splunk/share/splunk/search_mrsparkle/modules.new: remove failed: No such file or directory
warning: file /opt/splunk/ftr: remove failed: No such file or directory

Re: Uninstall Splunk on Linux

isoutamo — Fri, 21 Feb 2020 22:18:25 GMT

It is warning that there are some files which are not part of that rpm package. Basically you should remove those after uninstall by rm -fr /opt/splunk.

Also remember possible volumes and/or SPLUNK_DB -directory if those are somewhere else than /opt/splunk/var/lib

Btw. It’s better to use yum remove splunk than rpm -e if yum is in use. Pure rpm can generate som lock issues to rpm db.

Ismo

Re: Uninstall Splunk on Linux

codebuilder — Mon, 24 Feb 2020 17:28:59 GMT

Agree with @soutamo , yum remove is always better practice, if available on your distro.