topic Re: How do I remove an app? in Splunk Search

How do I remove an app?

jared_anderson — Wed, 09 Jan 2013 16:50:59 GMT

I see questions about difference between deleting apps and disabling them. I don't see how to actually delete them.

Re: How do I remove an app?

ChrisG — Wed, 09 Jan 2013 17:26:48 GMT

See Manage app and add-on objects > Uninstall an app in the Admin Manual. Basically, just remove the app directory itself and and user-specific app directories under /etc/users/. You can also remove the app's indexed data if you want to.

Re: How do I remove an app?

johnebgood — Mon, 28 Sep 2020 13:04:32 GMT

$SPLUNK_HOME/bin/splunk remove app

Re: How do I remove an app?

jared_anderson — Wed, 09 Jan 2013 19:01:43 GMT

Do I do this through command line?

Re: How do I remove an app?

jared_anderson — Wed, 09 Jan 2013 19:05:38 GMT

I deleted those directories, then on splunk the apps acted like an empty link. Now the directories have been recreated, and the apps work again.

Re: How do I remove an app?

ChrisG — Wed, 09 Jan 2013 19:24:00 GMT

Did you restart Splunk after you deleted the directories? I added that to the docs topic, sorry it wasn't there before.

Re: How do I remove an app?

jared_anderson — Wed, 09 Jan 2013 19:31:26 GMT

Great that fixed it. Thanks for your help and quick response.

Re: How do I remove an app?

johnebgood — Wed, 09 Jan 2013 22:30:59 GMT

Yes, "splunk remove app " is ran from the splunk bin directory.

Re: How do I remove an app?

rodrigorsilva — Fri, 20 Feb 2015 17:39:06 GMT

It worked fine, just located the app name in the Apps > Manage Apps > "folder name". Thank you very much.

Re: How do I remove an app?

sameeripro — Sun, 18 Oct 2015 07:51:29 GMT

Go to directory

/opt/splunk/etc/apps

rm -rf [app name]

Restart splunk

Re: How do I remove an app?

duartet — Mon, 26 Mar 2018 13:27:05 GMT

This is by far the best answer, which can be seen here:

http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Managingappobjects

Re: How do I remove an app?

noy72 — Tue, 29 Sep 2020 23:11:36 GMT

I am attempting to remove the Cisco ISE app. I have removed the folder from /etc/apps, but when I try to delete the Splunk_TA_cisco-ie folder, it is in use. What services do I need to stop in order to stop Splunk and be able to remove the TA folder? Sorry Windows 2012R2 in an AD environment, Single Splunk Enterprie instance. Version 7.1.3
Thanks in advance.

Re: How do I remove an app?

pir8radio — Fri, 01 May 2020 22:49:22 GMT

the link in your answer is no longer valid.

Re: How do I remove an app?

indut — Tue, 03 Nov 2020 10:12:02 GMT

This worked for me, thank you

Re: How do I remove an app?

highsplunker — Mon, 18 Jan 2021 20:04:37 GMT

(under the link)

Thanks a lot.

Uninstall an app or add-on

To remove an installed app from a standalone Splunk platform installation:

(Optional) Remove the app or add-on's indexed data. Typically, the Splunk platform does not access indexed data from a deleted app or add-on. However, you can use the Splunk CLI clean command to remove indexed data from an app before deleting the app. See Remove data from indexes with the CLI command.
Delete the app and its directory. The app and its directory are typically located in $SPLUNK_HOME/etc/apps/<appname>. You can run the following command in the CLI:
./splunk remove app [appname] -auth <username>:<password>
You may need to remove user-specific directories created for your app or add-on by deleting any files found here: $SPLUNK_HOME/etc/users/*/<appname>
Restart the Splunk platform.