Removing Enterprise Security

[calebra05]

Dear All,

With the deletion of App for Vmware from CLI, somehow I managed to ruin our Enterprise Security.
The app (and every menu of it) starts with a message "Timelines could not be loaded" and some dashboards are missing
(Unable to load results and "Error in 'SearchParser': The search specifies a macro 'stats2chart'/'allow_old_summaries_bool'/etc that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information."), so I reached to the point that I would like to purge Enterprise Security and then reinstall it.
I've already tried to update the app but nothing happened.
I cannot find any documentation how to remove the app and I don't know which directories to delete from /opt/splunk/etc/apps.

Could you please help me with this?

[sowings · Accepted solution]

It sounds like the biggest issue is the removal of SA-Utils; this Supporting Add-On (SA) represents common code utilized by both applications. You may be able to restore it with the least disruption of your install. The SplunkEnterpriseSecuritySuite application (directory) should have an install subdir. Contained there should be an "SA-Utils-<ver>.spl". This is just a tarball. If you unpack this into the /opt/splunk/etc/apps folder and restart the instance, you may find that you don't have to do a full reinstall.

[calebra05]

Dear sowings,

I really appreciate the solution you provided. I copied just the SA-Utils directory to the apps folder and restarted Splunk and now Enterprise Security is working perfectly, no errors, and the same old dashboards appeared.
Thank you very much!

Best Wishes.