Clean up older installations

Clean up older versions of Splunk for VMware

If you have a version of Splunk for VMware prior to the 1.0GA release installed and deployed in your environment, remove it and clean up your installation before you deploy Splunk for VMware 1.0GA.

Remove the Splunk App for VMware

To remove the Splunk App for VMware from all of your search heads/indexers:

1. Stop Splunk on all search heads/indexers where the Splunk App for VMware was installed.
2. Copy your $SPLUNK_HOME/etc/apps/splunk_for_vmware/local directory to a temporary location. The local directory contains all of the customizations that you made in the App (custom views, saved searches, macros, and so on).
3. Go to $SPLUNK_HOME/etc/apps/splunk_for_vmware to locate the App and remove the entire App directory and all of its sub-directories on all of your search heads / indexers.
4. Remove all of the old VMware data on all of your search heads/indexers:

   splunk clean eventdata vmware -f

5. You can now install Splunk for VMware 1.0 on your search heads/indexers. See the Splunk for VMware Installation and Configuration Guide for detailed instructions. If you do not want to install Splunk for VMware, you can start your Splunk instance on all of your search heads/indexers now.

Remove the Splunk Add-on for vCenter

To remove the Splunk Add-on for vCenter from your vCenter Server forwarders:

1. On the vCenter Server machines where the previous Splunk Add-on for vCenter version was installed, shut down the Splunk forwarder.
2. If you created an inputs.conf.template file (containing your VC instance name) in $SPLUNK_HOME/etc/apps/splunk_for_vmware_vcenter/local, copy it to a temporary location.
3. Remove the entire Add-on directory, $SPLUNK_HOME/etc/apps/splunk_for_vmware_vcenter , and all of its sub-directories on all of your vCenter Servers.
4. You can now install Splunk for VMware 1.0 on your vCenter forwarders. See the Splunk for VMware Installation and Configuration Guide for instructions on how to do this. If you do not want to install Splunk for VMware 1.0, start the Splunk forwarder on all of your vCenter Servers now.

Shut down and de-commission the Splunk FA VM

To shut down and de-commission the Splunk FA VM:

1. Log into the FA VM as the “splunkadmin” user.
2. Stop splunk in the FA VM:

   splunk stop

3. Copy all custom configurations that you made in your FA VM (for example, outputs.conf, engine.conf, inputs.conf) and save a copy of your “local” config files to a temporary location. You can find all the files in #: $SPLUNK_HOME/etc/apps/splunk_for_vmware/local or $SPLUNK_HOME/etc/system/local.
4. Shutdown the OS and halt operation:

   sudo shutdown –h now

5. Your previous FA VM version is now de-commissioned and you can deploy a new version of the FA VM. See the Splunk for VMware Installation and Configuration Guide for instructions on how to install Splunk for VMware 1.0.