topic Re: How to remove an app from a search head cluster and cluster peers? in Deployment Architecture

How to remove an app from a search head cluster and cluster peers?

ishaanshekhar — Tue, 29 Sep 2020 07:28:27 GMT

I wish to uninstall an app from my Search Head cluster and cluster peers. Is this the following the way to go about it?

On each Search Head and peer cluster member:

1.Run the following command in CLI

./splunk remove app [appname] -auth <username>:<password>

2.Remove user-specific directories created for your app or add-on by deleting the files found here:

   $SPLUNK_HOME/splunk/etc/users/*/<appname>

And, If the instance is a search peer, also delete the relevant index

4.Restart Splunk

Then,
Delete directory from $SPLUNK_HOME/etc/master-apps in Master Node
Delete directory from $SPLUNK_HOME/etc/shcluster/apps in Deployer

=====

Or, is there a central way to do this from the Deployer/Master?

Re: How to remove an app from a search head cluster and cluster peers?

Steve_G_ — Mon, 05 Oct 2015 19:23:30 GMT

All you need to do is to delete the app from $SPLUNK_HOME/etc/shcluster/apps on the deployer and then run "splunk apply shcluster-bundle". This will remove it from all cluster members.

This is documented in http://docs.splunk.com/Documentation/Splunk/6.3.0/DistSearch/PropagateSHCconfigurationchanges .

Re: How to remove an app from a search head cluster and cluster peers?

ishaanshekhar — Tue, 06 Oct 2015 05:52:23 GMT

Thank you! How about for the Indexer cluster app?

Re: How to remove an app from a search head cluster and cluster peers?

Steve_G_ — Tue, 06 Oct 2015 22:51:19 GMT

Yes, the same method works to remove an app from the peers on an indexer cluster.

Re: How to remove an app from a search head cluster and cluster peers?

ishaanshekhar — Thu, 08 Oct 2015 09:12:19 GMT

Thanks! How about the associated indexes? Do I need to delete those one by one on each indexer?

Re: How to remove an app from a search head cluster and cluster peers?

adevi — Thu, 20 Oct 2016 14:42:58 GMT

What if the app to be removed was the only app deployed? When I issued the "splunk apply shcluster-bundle" command, it came back saying there should be atleast one app to push the configuration. How do I delete my only app using deployer ?

Re: How to remove an app from a search head cluster and cluster peers?

nawazns5038 — Thu, 17 Jan 2019 20:55:05 GMT

you can create a sample app(a folder in shcluster/apps directory) with zero or uneffecting configs like app.conf and push the bundle

Re: How to remove an app from a search head cluster and cluster peers?

Pagadala1995 — Tue, 09 Jul 2019 13:07:35 GMT

Delete the app from $SPLUNK_HOME/etc/shcluster/apps on the deployer and then run below command to remove the apps from all cluster members.

./splunk apply shcluster-bundle -target uri -force true -auth username:password

WARNING: using force option with an empty shcluster directory will delete all apps previously deployed to the search head cluster; use with extreme caution!

Re: How to remove an app from a search head cluster and cluster peers?

moliminous — Thu, 17 Oct 2019 16:35:20 GMT

To push an empty bundle, use the '-force true' flag, syntax would be:
splunk apply shcluster-bundle --answer-yes -force true -target : -auth :

Re: How to remove an app from a search head cluster and cluster peers?

moliminous — Thu, 17 Oct 2019 16:37:43 GMT

Not quite the same, the caveat being that a SHC Deployer can overwrite /opt/splunk/etc/apps/ on the SHC members, but a Cluster Master will only control what is contained in /opt/splunk/etc/slave-apps/ on the Indexers. For Indexers, you would still need to manually clean up /opt/splunk/etc/apps/ regardless if they are a member of a cluster or not.

Re: How to remove an app from a search head cluster and cluster peers?

mustapha_arakji — Wed, 01 Feb 2023 23:27:08 GMT

All peer nodes share a common configuration that's managed by the manager node. So index configuration can be controlled from the manager node.

https://docs.splunk.com/Documentation/Splunk/9.0.3/Indexer/Updatepeerconfigurations

Re: How to remove an app from a search head cluster and cluster peers?

isoutamo — Thu, 02 Feb 2023 17:10:01 GMT

If you are removing index definition from CM’s indexes.conf it just removes that definition from peers’ configuration, BUT it don’t remove actual index directories/events from disk. Those you must remove manually from every nodes.