All Apps and Add-ons

Removing the Splunk Stream app

pil321
Communicator

When I try to remove Splunk Stream (delete the 'Splunk_TA_stream' directory from /opt/splunk/etc/apps - restart splunk), the directory reappears when I restart Splunk (?)

Is there a way to permanently delete it?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Splunk Stream app is in two directories, splunk_app_stream and Splunk_TA_stream. Both must be removed to uninstall the app.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sbbadri
Motivator

If you are using Deployment server to push Splunk_TA_stream to splunk UF
GO to Deployment server
1) Delete app from $SPLUNK_HOME$/etc/deployment-apps
2) Delete corresponding app class configuration from $SPLUNK_HOME/etc/system/local/serverclass.conf
3) Restart splunk

if you are using deployer to push Splunk_TA_stream to Splunk Search Heads
Go to Deployer
1) Delete app from $SPLUNK_HOME$/etc/shcluster/apps/
2) $SPLUNK_HOME/bin apply shcluster-bundle -target https://:8089 -preserve-lookups true

0 Karma

pil321
Communicator

Not using a deployment server or deployer - it was installed directly on a single instance.

0 Karma

sbbadri
Motivator

ah okay. Then try removing user specific directories created for that app.

Remove app

  $SPLUNK_HOME/bin/splunk remove app [appname] -auth <username>:<password>

Remove user-specific directories created for your app or add-on by deleting the files found here:

   $SPLUNK_HOME/etc/users/*/<appname>

Restart Splunk

0 Karma

pil321
Communicator

Thanks for the reply's, This is one tough app!

I did what sbbadri suggested, but once the app is removed and the user-specific directories are removed when Splunk is restarted, it's back again!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...