topic What is the preferred way to remove a deployed application on a host? in Deployment Architecture

What is the preferred way to remove a deployed application on a host?

lisaac — Tue, 13 Apr 2010 00:01:20 GMT

I have deployed an application via the deployment server. What is the preferred way to remove an app from a deployment client? It appears that the action can be completed by updating the whitelist or blacklist for the server class.

Re: What is the preferred way to remove a deployed application on a host?

Chris_R_ — Tue, 13 Apr 2010 00:20:29 GMT

The app can simply be removed by deleting the contents of $SPLUNK_HOME/apps/< appname > on the client

You will of course have to remove the entry on your deployment server so the app does not get deployed again. Check in your $SPLUNK_HOME/etc/system/local/serverclass.conf which deploys that app to the client.

Look for the hostname or ip, something like

[serverClass:myapp1]
whitelist.0=hostname.*
...other stuff...
[serverClass:myapp1:app:myapp1_inputs]
restartSplunkd = true

Re: What is the preferred way to remove a deployed application on a host?

Lowell — Tue, 13 Apr 2010 02:23:37 GMT

Chris R has a good approach if you are dealing with custom apps. However, if you are trying to disable built-in apps, such as SplunkForwarder or sample_app, you should consider disabling these apps instead of removing them. The reason being is that next time you install a Splunk upgrade, these apps will get re-installed and will be enabled again if you only removed the app folder.

One approach to wiping out an app is to create an empty app folder with nothing but the local/app.conf file, with the following content:

[install]
state = disabled

Re: What is the preferred way to remove a deployed application on a host?

ben_leung — Wed, 09 Jul 2014 01:12:42 GMT

This disables the app? Or does it remove the custom app folder from the deployment clients as well?