https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116821#M264 <P>But after that i have seen that some apps like Deep security and Fortinet stopped collecting the data in real time..</P> Thu, 12 Nov 2015 10:34:01 GMT saurabh_tek 2015-11-12T10:34:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116817#M260 <P>I tried $SPLUNK_HOME$/bin/splunk remove app SplunkEnterpriseSecuritySuite and it tells me "app doesn't exist" -- It does... I'm looking at it. Same thing when I try to uninstall any of the SA or DA apps using the splunk binary.</P> <P>I'm about to hard rip the directories but I just wanted to check to see if anyone had a more elegant way of doing this.</P> Wed, 02 Apr 2014 16:20:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116817#M260 proletariat99 2014-04-02T16:20:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116818#M261 <P>Deleting the apps in the app directories is the way I did it, it worked like a charm and was though it never existed.</P> Wed, 02 Apr 2014 16:37:00 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116818#M261 aelliott 2014-04-02T16:37:00Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116819#M262 <P>Thanks. I just needed one confirmation before I felt okay pulling the trigger. </P> <P>So I removed all the apps by using the following commands:<BR /> $ rm -rf SplunkEnterpriseSecurity*<BR /> $ rm -rf SA-*<BR /> $ rm -rf DA-ESS*</P> <P>The only thing to note is that my local splunk (6.0) instance went from using ssl (<A href="https://127.0.0.1:8000">https://127.0.0.1:8000</A>) to not ssl (<A href="http://127.0.0.1:8000">http://127.0.0.1:8000</A>). </P> <P>I thought that was odd, because I didn't change anything else.</P> Wed, 02 Apr 2014 17:02:41 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116819#M262 proletariat99 2014-04-02T17:02:41Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116820#M263 <P>Hey proletariat99, the change from https to http is expected. The Splunk App for Enterprise Security changes splunkweb from http to https, so upon removal, it would revert back.</P> <P>Also, if you're antsy about removing apps in the future, you can just move an app to the disabled-apps directory $SPLUNK_HOME/etc/disabled-apps) and restart. That way they're always there if you want to move them back.</P> Wed, 02 Apr 2014 17:13:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116820#M263 mloven_splunk 2014-04-02T17:13:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116821#M264 <P>But after that i have seen that some apps like Deep security and Fortinet stopped collecting the data in real time..</P> Thu, 12 Nov 2015 10:34:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116821#M264 saurabh_tek 2015-11-12T10:34:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116822#M265 <P>Did not noticed disabled-apps before. Interesting.</P> Tue, 24 Oct 2017 17:30:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-does-one-remove-the-Enterprise-Security-Suite/m-p/116822#M265 wrangler2x 2017-10-24T17:30:42Z