Note: These uninstallation instructions are derived from Splunk’s official documentation on removing apps.
Removing the PowerConnect Index (Optional)
In single instance Splunk deployments, the data index associated with the PowerConnect app is automatically removed from Splunk after uninstalling the app. However, the data is retained on the host system’s file structure. Capacity on the host can be freed by formally deleting the index through Splunk Web. Distributed deployments should retain the data, which will eventually age out and be removed by Splunk automatically.
Log into Splunk as an administrative user capable of removing index data (see Splunk documentation)
Go to Settings > Data > Indexes
Find the index associated with the PowerConnect (typically “sap”) and click “Delete”
Confirm the action by clicking “Delete” when prompted
Removing the PowerConnect Role (Optional)
The role created for accessing data under the index created for PowerConnect is rendered functionally useless after uninstalling the PowerConnect app. It can be removed through Splunk Web
Go to Settings > Users and Authentication > Roles
Find the role(s) created for accessing the PowerConnect index
Click Edit > Delete
Backing up the PowerConnect App - Splunk Enterprise
Backing up the PowerConnect may involve two different types of data: configuration files and indexed data.
For configuration files, create a copy of the $SPLUNK_HOME/etc/apps/BNW-app-powerconnect folder.
Additionally, you may want to back up individual user configurations in the app. Those can be found at $SPLUNK_HOME/etc/users/<username>/BNW-app-powerconnect
Configuration files include (but may not be limited to) the following objects:
Configuration settings
Saved Searches
User Accounts
Tags
Custom Sourcetype Names
For distributed deployments, perform configuration backups from the cluster manager and/or search heads
For the indexed data, you will need to back up the folders for the PowerConnect index (typically called “sap”). For more information, see Splunk’s documentation on backing up indexed data.
This will likely be a large amount of data. Make sure you have storage capacity in place for a complete backup.
Uninstalling the PowerConnect App - Splunk Enterprise
This app can be uninstalled the same way as any Splunk app. Back up configuration files—and possibly data—before doing so. However, it is recommended to disable the app via the Splunk Web UI if it is not needed. If uninstallation is required:
Log into the host machine as the user running Splunk.
For any machine running a desktop interface, open a CLI
Enter the following command into the CLI
./splunk remove app BNW-app-powerconnect -auth <splunk_username>:<password>
Note: If the “./splunk” command is not registered in the system, the full path to the Splunk executable must be given instead (Example: “/opt/splunk/bin/splunk”). Alternatively, you can add the path to the Splunk executable in the system’s PATH environment variable, allowing you to call the Splunk command on its own
(Optional) Additional cleanup can be performed by removing the “BNW-app-powerconnect” folder from each user directory within the Splunk file system
It is recommended to restart Splunk after performing the uninstall
Uninstalling the PowerConnect App - Splunk Cloud Platform
The PowerConnect app is treated as a “private app” on the Splunk Cloud platform and can be uninstalled through Splunk Web. See Splunk’s documentation on managing private apps in Splunk Cloud.
Log into Splunk Cloud
Click the gear icon (Settings) next to the app listing
Find your app on the App Management page
Click “Uninstall.”
Confirm when prompted
The latest version of the app uploaded will still be available for reinstallation via the App Management page.