When I try to remove Splunk Stream (delete the 'Splunk_TA_stream' directory from /opt/splunk/etc/apps - restart splunk), the directory reappears when I restart Splunk (?)
Is there a way to permanently delete it?
The Splunk Stream app is in two directories, splunk_app_stream and Splunk_TA_stream. Both must be removed to uninstall the app.
If you are using Deployment server to push Splunk_TA_stream to splunk UF
GO to Deployment server
1) Delete app from $SPLUNK_HOME$/etc/deployment-apps
2) Delete corresponding app class configuration from $SPLUNK_HOME/etc/system/local/serverclass.conf
3) Restart splunk
if you are using deployer to push Splunk_TA_stream to Splunk Search Heads
Go to Deployer
1) Delete app from $SPLUNK_HOME$/etc/shcluster/apps/
2) $SPLUNK_HOME/bin apply shcluster-bundle -target https://:8089 -preserve-lookups true
Not using a deployment server or deployer - it was installed directly on a single instance.
ah okay. Then try removing user specific directories created for that app.
Remove app
$SPLUNK_HOME/bin/splunk remove app [appname] -auth <username>:<password>
Remove user-specific directories created for your app or add-on by deleting the files found here:
$SPLUNK_HOME/etc/users/*/<appname>
Restart Splunk
Thanks for the reply's, This is one tough app!
I did what sbbadri suggested, but once the app is removed and the user-specific directories are removed when Splunk is restarted, it's back again!