Archive2

Clean way of uninstalling a Splunk App

Contributor

What's a good way to completely uninstall an installed app?

Tags (1)
1 Solution

Builder

It's as simple as deleting the folder in $SPLUNK_HOME/etc/apps/ and restarting splunk.

View solution in original post

Influencer
  • Remove app

    $SPLUNK_HOME/bin/splunk remove app [appname] -auth :

  • Remove user-specific directories created for your app or add-on by deleting the files found here:

    $SPLUNK_HOME/etc/users/*/

  • Restart Splunk

Splunk Employee
Splunk Employee

You can delete the app folder from $SPLUNK_HOME/etc/apps, but if the app had any side-effects (in particular, creating indexes, indexing new data, or transforming indexed data while the app was present), that will not be reversed by the deletion of the app. For example, the Unix app creates an os index and fills it with data, and this is not removed if you remove the app. Similarly, the sample_app creates a sample index, while the windows app adds new data to your main index.

Contributor

Would there be a future release that would include the dependencies created by the initial app to be removed upon removal of the app?

Contributor

This is great! I also found that the command "splunk remove app removes Splunk app.

Contributor

I'm trying to remove the app I've downloaded from the App repository. I'm not going to be able to use the app, so I'd rather remove it clean.

0 Karma
Reply

Splunk Employee
Splunk Employee

Were you trying to remove the app using the launcher and/or manager? I ran into this the other day in my test instance. It feels like you should be able to kill it from manager. Thoughts?

0 Karma
Reply

Builder

It's as simple as deleting the folder in $SPLUNK_HOME/etc/apps/ and restarting splunk.

View solution in original post