We are using splunk in Enterprise environemnt with Very large scale operation.
Management decided to address the question why is the above mentioned app included in the package?
We are not using it and would like not to have it in the future.
The show case package should be optional. As of now it we have 60 pluss Splunk Enterprise server and this takes space on all of them. It does not help to just remove the folder. 1. We get error on staring Splunk due to the manifest files. 2. It will just be reinstalled on next upgrade.
I see what you are saying, on my test instance with 8.2.5 the splunk_essentials app is there and uses approx 4mb.
The good news is that when Ive come to upgrade it to 9.1.x I can see that the splunk_essentials app is not there, so I wonder if this is now going to be excluded moving forwards.
Hopefully for future versions you will not need to worry about this.
This app is just a showcase of new features and introductions to various parts of the product. If it is getting in the way then you could change the permissions so that your users dont see it, you could disable it, or remove it entirely.