How do I uninstall an app from a search head cluster?

[TheBravoSierra]

In Splunk Enterprise, prior versions, I used to be able to: 

Cd /opt/splunk/etc/shcluster/apps
rm -rf this_old_app
Apply shcluster bundle

Now when I go to apply the bundle to the members, it says directory is nonempty, unable to remove. How are apps uninstalled/removed now? Running version 9.4.3. 

[PrewinThomas · Accepted solution]

@TheBravoSierra 

If the app was originally deployed via deployer your steps should work.
Ensure the directory is completely gone (no hidden files/permission issues).

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[livehybrid]

Hi @TheBravoSierra 

Was the app originally installed via the SH Deployer?

If so you should be able to remove by removing the app from  /opt/splunk/etc/shcluster/apps as you suggested, however this will only work if the app was installed from the SH Deployer *and* the app is not disabled.

https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges

"To delete an app that you previously pushed, remove it from the configuration bundle. When you next push the bundle, each member will delete it from its own file system. Note: If you need to remove an app, inspect its app.conf file to make sure that state = enabled. If state = disabled, the deployer will not remove the app even if you remove it from the configuration bundle."

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[VatsalJagani]

@TheBravoSierra - It should delete the App from SH members as well with your steps.

Only one thing document which could affect it is that when App is disabled, SHC member will not remove the App.