Uninstall Splunk Security Essentials
You can uninstall Splunk Security Essentials from either the user interface or the command line.
Uninstall Splunk Security Essentials from the user interface
If you are a cloud user of Splunk Security Essentials, you can uninstall Splunk Security Essentials from the user interface.
- From Splunk Enterprise or Splunk Cloud Platform, select Apps then Manage Apps.
- Find the entry for Splunk Security Essentials and select Uninstall.
Uninstall Splunk Security Essentials from the command line
To remove Splunk Security Essentials from the command line, follow these steps:
- (Optional) Remove the app or add-on's indexed data. Typically, the Splunk platform does not access indexed data from a deleted app or add-on. However, you can use the Splunk CLI clean command to remove indexed data from an app before deleting the app. See Remove data from indexes with the CLI command.
- Delete the app and its directory. The app and its directory are typically located in
$SPLUNK_HOME/etc/apps/<appname>. You can run the following command in the CLI: - You may need to remove user-specific directories created for your app or add-on by deleting any files found here:
$SPLUNK_HOME/etc/users/*/<appname> - Restart the Splunk platform.