Uninstalling/Disabling of ITEW/ITSI in Splunk Cloud

Available Languages

Updated:September 29, 2026
Document ID:SPLK049179

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk IT Service Intelligence - #1841 IT Essentials Work - #5403 Splunk App for Content Packs - #5391

Description

  • IT Essentials Work (ITEW) is a Standard app whereas, Splunk IT Service Intelligence  (ITSI) is a premium app.
  • If the user is facing any issue regarding these apps, it can be disabled or uninstalled from the stack.
  • Disabling the app means the user wishes to use it again, whereas if the app is uninstalled it can be Installed again with all the dependent packages.
  • Disabling ITEW/ITSI is not recommended instead, it is suggested to uninstall it completely.
  • ITEW/ITSI has a dependent app "Splunk App for content packs ", which will also be disabled/uninstalled with all its Content packages.
  • The user can also uninstall/disable apps via the Manage page UI.

 

Investigation

Apps & Add-ons Locations
Here is a list of apps to gauge what is installed with ITSI/ITEW. (Varies with the ITSI version)
 

Premium SH
/opt/splunk/etc/apps

DA-ITSI-APPSERVER
DA-ITSI-LB
DA-ITSI-VIRTUALIZATION
SA-ITSI-ATAD
SA-ITSI-MetricAD
itsi
DA-ITSI-DATABASE
DA-ITSI-OS
DA-ITSI-WEBSERVER
SA-ITSI-CustomModuleViz
SA-IndexCreation
DA-ITSI-EUEM
DA-ITSI-STORAGE
SA-ITOA
SA-UserAccess

Indexers

/opt/splunk/etc/slave-apps (Classic) 
/opt/splunk/etc/apps (Noah)

SA-IndexCreation

Cluster Manager

/opt/splunk/etc/apps

itsi
SA-ITSI-Licensechecker
SA-UserAccess
/opt/splunk/etc/master-apps (Classic)
SA-IndexCreation
Content Package apps (#5391):
DA-ITSI-CP-SERVICENOW
DA-ITSI-CP-aws-dashboards
DA-ITSI-CP-citrix
DA-ITSI-CP-cloud-foundry
DA-ITSI-CP-example-gts
DA-ITSI-CP-itew-alerting-content
DA-ITSI-CP-m365
DA-ITSI-CP-microsoft-exchange
DA-ITSI-CP-monitoring-alerting
DA-ITSI-CP-monitoring-splunk
DA-ITSI-CP-netapp-dashboards
DA-ITSI-CP-nix
DA-ITSI-CP-shared-infra
DA-ITSI-CP-soar
DA-ITSI-CP-splunk-observability
DA-ITSI-CP-splunk-synthetics
DA-ITSI-CP-thirdparty-apm
DA-ITSI-CP-unix-dashboards
DA-ITSI-CP-vmware
DA-ITSI-CP-vmware-dashboards
DA-ITSI-CP-windows
DA-ITSI-CP-windows-dashboards
DA-ITSI-ContentLibrary

 

Resolution

Disabling/uninstalling ITSI/ITEW from the Splunk Cloud instance will lead to disabling/uninstalling all the packages gauge with ITSI/ITEW and also the Content packages.

Conclusion: The User won't be able to use any of the dependent packages of ITEW/ ITSI and Content packs.
Manage apps on UI ( Uninstall apps)

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products