How to remove/uninstall an app

[Roy_9]

Hello,

We have few apps that are no longer needed in our on premise environment. We maintain git repo for configs.

Can anyone please help me with the steps to uninstall/remove the app.

Thanks

[richgalloway · Accepted solution]

The procedure varies depending on the environment.

In a standalone server or independent search heads, indexers, and heavy forwarders, just remove the app directory from $SPLUNK_HOME/etc/apps and restart Splunk.

In a search head cluster, remove the app from $SPLUNK_HOME/etc/shcluster on the SHC Deployer and push the shbundle.

In an indexer cluster, remove the app from $SPLUNK_HOME/etc/manager-apps (or master-apps) and push the bundle.

For universal forwarders, remove the app from the appropriate server class(es).  If no clients use the app, it can be removed from $SPLUNK_HOME/etc/deployment-apps.

[paddygriffin]

does removing it from the serverclass cause it to be deinstalled on the forwarders in the class?

[richgalloway]

Yes, removing an app from the server class will cause the client to uninstall that app.