Archive
Highlighted

Removing the Splunk Stream app

Communicator

When I try to remove Splunk Stream (delete the 'SplunkTAstream' directory from /opt/splunk/etc/apps - restart splunk), the directory reappears when I restart Splunk (?)

Is there a way to permanently delete it?

0 Karma
Highlighted

Re: Removing the Splunk Stream app

Motivator

If you are using Deployment server to push SplunkTAstream to splunk UF
GO to Deployment server
1) Delete app from $SPLUNKHOME$/etc/deployment-apps
2) Delete corresponding app class configuration from $SPLUNK
HOME/etc/system/local/serverclass.conf
3) Restart splunk

if you are using deployer to push SplunkTAstream to Splunk Search Heads
Go to Deployer
1) Delete app from $SPLUNKHOME$/etc/shcluster/apps/
2) $SPLUNK
HOME/bin apply shcluster-bundle -target https://:8089 -preserve-lookups true

0 Karma
Highlighted

Re: Removing the Splunk Stream app

Communicator

Not using a deployment server or deployer - it was installed directly on a single instance.

0 Karma
Highlighted

Re: Removing the Splunk Stream app

Motivator

ah okay. Then try removing user specific directories created for that app.

Remove app

  $SPLUNK_HOME/bin/splunk remove app [appname] -auth <username>:<password>

Remove user-specific directories created for your app or add-on by deleting the files found here:

   $SPLUNK_HOME/etc/users/*/<appname>

Restart Splunk

0 Karma
Highlighted

Re: Removing the Splunk Stream app

Communicator

Thanks for the reply's, This is one tough app!

I did what sbbadri suggested, but once the app is removed and the user-specific directories are removed when Splunk is restarted, it's back again!

0 Karma
Highlighted

Re: Removing the Splunk Stream app

SplunkTrust
SplunkTrust

The Splunk Stream app is in two directories, splunkappstream and SplunkTAstream. Both must be removed to uninstall the app.

---
If this reply helps you, an upvote would be appreciated.
0 Karma