Note: These uninstallation instructions are derived from Splunk’s official documentation on removing apps.
You may need to remove the PowerConnect Splunk app for a variety of reasons. If you do—and you are running the Splunk app on Splunk Enterprise—we first recommend that you create a backup of the configuration files and/or indexed data (see KB 146 - Backing up the PowerConnect App in Splunk Enterprise). Manual backups cannot be done in Splunk Cloud.
Removing the PowerConnect Index (Optional)
...
Find the role(s) created for accessing the PowerConnect index
...
Click Edit > Delete
...
Backing up the PowerConnect may involve two different types of data: configuration files and indexed data.
For configuration files, create a copy of the $SPLUNK_HOME/etc/apps/BNW-app-powerconnect folder.
Additionally, you may want to back up individual user configurations in the app. Those can be found at $SPLUNK_HOME/etc/users/<username>/BNW-app-powerconnect
Configuration files include (but may not be limited to) the following objects:
Configuration settings
Saved Searches
User Accounts
Tags
Custom Sourcetype Names
For distributed deployments, perform configuration backups from the cluster manager and/or search heads
For the indexed data, you will need to back up the folders for the PowerConnect index (typically called “sap”). For more information, see Splunk’s documentation on backing up indexed data.
This will likely be a large amount of data. Make sure you have storage capacity in place for a complete backup.
Uninstalling the PowerConnect App - Splunk Enterprise
This app can be uninstalled the same way as any Splunk app. Back up configuration files—and possibly data—before doing so. However, it is recommended to disable the app via the Splunk Web UI if it is not needed. If uninstallation is required:
...