Uninstalling the QRadar App for Splunk Data Forwarding

Use the IBM® QRadar® Extensions Management tool to uninstall the app from your QRadar Console. When you uninstall an app, it is removed from the system. If you want to use the app again, you must reinstall it.


  1. On the Admin tab, in the System Configuration section, click Extensions Management.
  2. On the Installed tab in the Extensions Management window, select your app and click Uninstall.
    Warning: The data is still forwarded from Splunk to QRadar unless you stop it from forwarding before you uninstall the app. To stop Splunk from forwarding data to QRadar, go to the Forwarded Data Sources tab, select the relevant Splunk instances, and click Stop Forwarding.