Removing the Splunk Stream app

[pil321]

When I try to remove Splunk Stream (delete the 'Splunk_TA_stream' directory from /opt/splunk/etc/apps - restart splunk), the directory reappears when I restart Splunk (?)

Is there a way to permanently delete it?

[richgalloway]

The Splunk Stream app is in two directories, splunk_app_stream and Splunk_TA_stream. Both must be removed to uninstall the app.

[sbbadri]

If you are using Deployment server to push Splunk_TA_stream to splunk UF
GO to Deployment server
1) Delete app from $SPLUNK_HOME$/etc/deployment-apps
2) Delete corresponding app class configuration from $SPLUNK_HOME/etc/system/local/serverclass.conf
3) Restart splunk

if you are using deployer to push Splunk_TA_stream to Splunk Search Heads
Go to Deployer
1) Delete app from $SPLUNK_HOME$/etc/shcluster/apps/
2) $SPLUNK_HOME/bin apply shcluster-bundle -target https://:8089 -preserve-lookups true

[pil321]

Not using a deployment server or deployer - it was installed directly on a single instance.

[sbbadri]

ah okay. Then try removing user specific directories created for that app.

Remove app

  $SPLUNK_HOME/bin/splunk remove app [appname] -auth <username>:<password>

Remove user-specific directories created for your app or add-on by deleting the files found here:

   $SPLUNK_HOME/etc/users/*/<appname>

Restart Splunk

[pil321]

Thanks for the reply's, This is one tough app!

I did what sbbadri suggested, but once the app is removed and the user-specific directories are removed when Splunk is restarted, it's back again!