Reinstalling Splunk

Abass42 — Fri, 14 Jun 2024 19:57:22 GMT

I have been working on our Splunk Dev environment, and since then, I have reinstalled and uninstalled Splunk many times. I had a question as to why even on a fresh install, the apps, and a few other artifacts remain? Once i wipe all traces of splunk off a server, I would think that upon reinstall, it would be a fresh start. yet, some of the GUI settings remain, and even some apps on the specific servers remain.

I have one dev indexer, SH, and Forwarder. We have specific apps that i have installed for people months ago, and since then, have rm -rf all traces that I could find of splunk, and yet, upon reinstall of splunk, I still see those apps under /SPLUNK_HOME/etc/apps. I have the same tar that i am unzipping on each server. yet, things like that persist across the servers.

My question is, what is storing that info? For example, the app BeyondTrust-PMCloud-Integration/, located under /export/opt/splunk/etc/apps, persists throughout two or three reinstalls of splunk. Is the FS storing data about the Splunk install even after i rm -rf all of /export/opt/splunk? Im trying to fix some annoying issues for replication and such by just resetting the servers, since i am building them from ground up, but these servers are still retaining some stuff. I decided to redo Splunk dev after we kept having issues with the old Dev environment. I was wanting a completely fresh start, but it seems as if Splunk retains some things even after a full reset. So im not sure if some problems are still persisting because something from a previous install is still floating around somewhere. Thanks for any help

Re: Reinstalling Splunk

richgalloway — Sat, 15 Jun 2024 00:22:09 GMT

Everything Splunk knows about itself is in $SPLUNK_HOME (/export/opt/splunk, in this case). Once that directory is wiped, there will be no remnants of Splunk software on the system. Indexed data may remain, especially if $SPLUNK_DB is in a different mount point (as recommended).

Before re-installing Splunk, did you confirm the app directories are gone? Have you looked to see if they're part of the tarball you're expanding?

topic Reinstalling Splunk in Installation

Reinstalling Splunk

Re: Reinstalling Splunk