Knowledge Management

what directory to run rpm -e command from?


I've tried where I've installed from, where I've installed splunk, but none seem to work. It keeps telling me it isn't installed even though I used the rpm to install Splunk. What directory do I need to be in to uninstall?

0 Karma


This appears to be a question about your operating system package management, not about Splunk. What OS are you using and what command did you use to install Splunk?

Unless you configured it to do otherwise, all of Splunk's files are stored in the directory where you installed Splunk. The only exceptions would be the boot-start script (if you set boot-start on Linux) and the location of the indexes (if you changed it from the default).

So if you can't uninstall Splunk with the package manager, you should be able to simply delete the Splunk directory tree.
You should also kill any running Splunk processes, if there were any. (On Windows, Splunk runs as a service, so you would need to disable/delete the service.)

0 Karma


I used centOS, and installed using rpm -i splunk-package-name.rpm in the Downloads folder. It automatically installed to /opt/splunk.

I now I can delete Splunk manually, but then I also have to run a yum erase splunk command on top of that since it doesn't seem to uninstall correctly when I do that (when I run the rpm -i again, it tells me splunk is already installed even when I just manually uninstalled it).

The uninstall guide tells me to run rpm -e splunk-package-name, but it never mentions where and I can never get it to run..

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>