Splunk® Data Stream Processor

Install and administer the Data Stream Processor

On April 3, 2023, Splunk Data Stream Processor reached its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.

All DSP releases prior to DSP 1.4.0 use Gravity, a Kubernetes orchestrator, which has been announced end-of-life. We have replaced Gravity with an alternative component in DSP 1.4.0. Therefore, we will no longer provide support for versions of DSP prior to DSP 1.4.0 after July 1, 2023. We advise all of our customers to upgrade to DSP 1.4.0 in order to continue to receive full product support from Splunk.

Uninstall the Splunk Data Stream Processor

Once you uninstall the Splunk Data Stream Processor (DSP), you can perform a clean reinstallation. See Install the Data Stream Processor in this manual.

The following instructions assume that you have system administrator (root) permissions. If you do not have root permissions, you can use the sudo command to run the necessary scripts required to uninstall DSP.

Remove (leave) all worker nodes from the cluster

  1. On a controller node, locate the kube config file. This is usually stored at /\<dsp-dir\>/admin/kubeconfig.
  2. Copy this file to the worker node and save it as kube config.
  3. Export the environment variable KUBECONFIG by running the following command.
    export KUBECONFIG=\<path-to-kubeconfig-file\>
  4. Verify that the kube config file is applied by running the following command.
    kubectl get nodes
  5. From the working directory of a node, use the leave command.
    dsp leave

    Once the last node leaves the cluster, the uninstall process kicks off. You'll see the following output once complete.

    Thu Jun 18 14:41:53 UTC	k0s has been successfully uninstalled
  6. Remove the dsp-bootstrap service by running the following command:
    service=dsp-bootstrap.service; systemctl stop $service && systemctl disable $service && rm /etc/systemd/system/$service && systemctl daemon-reload && systemctl reset-failed && iptables -t nat -F && rm /etc/dsp/dsp.yaml
  7. Reboot the controller node.

Remove controller node from cluster

  1. From the working directory of a controller node, use the leave command.
    dsp leave
  2. Remove the dsp-bootstrap service by running the following command:
    service=dsp-bootstrap.service; systemctl stop $service && systemctl disable $service && rm /etc/systemd/system/$service && systemctl daemon-reload && systemctl reset-failed && iptables -t nat -F && rm /etc/dsp/dsp.yaml
  3. Reboot the controller node.

Depending on the state of your cluster, the uninstall process could take up to several hours to complete.

Last modified on 29 April, 2024
Upgrade the Splunk Data Stream Processor on the Google Cloud Platform   Cross-Origin Resource Sharing Policy

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.4.4, 1.4.5, 1.4.6


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters