How do I remove an app?

[jared_anderson]

I see questions about difference between deleting apps and disabling them. I don't see how to actually delete them.

[sameeripro]

Go to directory

/opt/splunk/etc/apps

ls

rm -rf [app name]

Restart splunk

[indut]

This worked for me, thank you

[johnebgood]

$SPLUNK_HOME/bin/splunk remove app

[noy72]

I am attempting to remove the Cisco ISE app. I have removed the folder from /etc/apps, but when I try to delete the Splunk_TA_cisco-ie folder, it is in use. What services do I need to stop in order to stop Splunk and be able to remove the TA folder? Sorry Windows 2012R2 in an AD environment, Single Splunk Enterprie instance. Version 7.1.3
Thanks in advance.

[duartet]

This is by far the best answer, which can be seen here:

http://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Managingappobjects

[highsplunker]

(under the link)

Thanks a lot.

Uninstall an app or add-on

To remove an installed app from a standalone Splunk platform installation:

1. (Optional) Remove the app or add-on's indexed data. Typically, the Splunk platform does not access indexed data from a deleted app or add-on. However, you can use the Splunk CLI clean command to remove indexed data from an app before deleting the app. See Remove data from indexes with the CLI command.
2. Delete the app and its directory. The app and its directory are typically located in $SPLUNK_HOME/etc/apps/<appname>. You can run the following command in the CLI:

   ./splunk remove app [appname] -auth <username>:<password>
3. You may need to remove user-specific directories created for your app or add-on by deleting any files found here: $SPLUNK_HOME/etc/users/*/<appname>
4. Restart the Splunk platform.

[rodrigorsilva]

It worked fine, just located the app name in the Apps > Manage Apps > "folder name". Thank you very much.

[johnebgood]

Yes, "splunk remove app " is ran from the splunk bin directory.

[jared_anderson]

Do I do this through command line?

[ChrisG · Accepted solution]

See Manage app and add-on objects > Uninstall an app in the Admin Manual. Basically, just remove the app directory itself and and user-specific app directories under /etc/users/. You can also remove the app's indexed data if you want to.

[pir8radio]

the link in your answer is no longer valid.

[jared_anderson]

Great that fixed it. Thanks for your help and quick response.

[ChrisG]

Did you restart Splunk after you deleted the directories? I added that to the docs topic, sorry it wasn't there before.

[jared_anderson]

I deleted those directories, then on splunk the apps acted like an empty link. Now the directories have been recreated, and the apps work again.