Uninstall Splunk SOAR (On-premises)

You can uninstall Splunk SOAR (On-premises) or remove and replace it with a new instance.

Uninstall the application

To uninstall Splunk SOAR (On-premises), run this command: 

<$PHANTOM_HOME>/soar-uninstall
CAUTION: If the soar-install script and the home directory for Splunk SOAR (On-premises) are in different locations, you must use the --phantom-home argument to tell the script where the home directory is.

If you specify --no-prompt, the script doesn't warn you before uninstalling Splunk SOAR (On-premises).

CAUTION: Although you can uninstall Splunk SOAR (On-premises), this process won't remove nodes from clusters.

Remove the application

To remove your existing Splunk SOAR (On-premises) installation or replace your existing installation with a new instance, perform these tasks:

  1. Create a fresh version of your operating system.
  2. Install Splunk SOAR (On-premises). Begin with How can Splunk SOAR (On-premises) be installed?