Getting Data In

Why am I unable to delete Splunk from an Ubuntu server?

splunkfly
New Member

I tried deleting Splunk completely from the Ubuntu server. I'm able to delete the splunk_home directory, but when I refresh I could see the Splunk directory again. I tried multiple times, but it is still not getting deleted. Under Splunk_Home I can barely see one directory Splunk_Home/var/

Please help me to delete this completely from my system. I stopped the Splunk server before I deleted with /bin/splunk stop

0 Karma

jensonthottian
Contributor

what user are you logged in as, do you have permissions to delete it.

Try doing a sudo su - root before using the rm command.

0 Karma

splunkfly
New Member

Yes, I'm a root user. I have all the permissions, it is getting deleted when i delete it, but after few minutes the directory appears again at the same location.

0 Karma

jensonthottian
Contributor

For sure you might have some process running which creates again files and dirs you just deleted.

Run the below and please provide the result:

cd /opt/splunk ; df .

0 Karma

splunkfly
New Member

Filesystem 1K-blocks Used Available Use% Mounted on
/dev/dm-0 80083800 2456832 73535884 4% /

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...