How to disable Splunk app with curl command?

[srinivasup]

Does anyone know the curl command to disable Splunk app?

[dineshraj9]

Try using the below CURL commands to enable/disable -

curl -k -u admin:password https://localhost:8089/servicesNS/nobody/-/apps/local/<your_app_name>/disable -X POST
curl -k -u admin:password https://localhost:8089/servicesNS/nobody/-/apps/local/<your_app_name>/enable -X POST

However, it will make the change only on the search head where you issue the CURL command. You may have to run the same command on all SHC peers.

[aaraneta_splunk]

@srinivasup - Were you able to test out renjith.nair's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

[renjith_nair]

Try

curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/<your app name>/configs/conf-app/install -d state=disabled

Reference :
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Appconf#.5Binstall.5D
https://docs.splunk.com/Documentation/Splunk/6.5.1/RESTREF/RESTconf#configs.2Fconf-.7Bfile.7D.2F.7Bs...

[dineshraj9]

I had tried this, but didn't work. Being a configuration it requires a restart for the state change to reflect.