Delete the app from $SPLUNK_HOME/etc/shcluster/apps on the deployer and then run below command to remove the apps from all cluster members. ./splunk apply shcluster-bundle -target uri -force true -auth username:password WARNING: using force option with an empty shcluster directory will delete all apps previously deployed to the search head cluster; use with extreme caution! ... View more