https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639772#M16018 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>, should I copy&nbsp;<SPAN>$SPLUNK_HOME/etc/instance.cfg and&nbsp;$SPLUNK_HOME/var/lib/splunk/fishbucket/ before or after the first run? I'd think it should be done before, but wouldn't that mess up with the first run executions?</SPAN></P> Thu, 13 Apr 2023 13:02:42 GMT ricotries 2023-04-13T13:02:42Z https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639687#M16005 <P>I have run into some cases where the best path forward was to reinstall a Universal Forwarder and point them to a Deployment Server to have a clean set of configurations. The problem is that if the same paths are monitored after the reinstallation, events could be reindexed. I know that I could potentially make a backup of the $SPLUNK_HOME/var/lib/splunk/fishbucket/ before uninstallation and place it on the new UF (<A href="https://community.splunk.com/t5/Getting-Data-In/How-can-I-prevent-reindexing-events-after-a-reinstall-of/m-p/376648#M68155" target="_blank" rel="noopener">Solved: How can I prevent reindexing events after a reinst... - Splunk Community</A>), but when I read some of the data in these files, I see references to the GUID of the current instance of the UF. Wouldn't this create a conflict with the new GUID generated for the new instance of the UF? How does Splunk treat this inconsistency?</P> Wed, 12 Apr 2023 20:17:03 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639687#M16005 ricotries 2023-04-12T20:17:03Z https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639770#M16017 <P>You can preserve the GUID by copying $SPLUNK_HOME/etc/instance.cfg and restoring it after the re-installation of the UF.</P> Thu, 13 Apr 2023 12:44:53 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639770#M16017 richgalloway 2023-04-13T12:44:53Z https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639772#M16018 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>, should I copy&nbsp;<SPAN>$SPLUNK_HOME/etc/instance.cfg and&nbsp;$SPLUNK_HOME/var/lib/splunk/fishbucket/ before or after the first run? I'd think it should be done before, but wouldn't that mess up with the first run executions?</SPAN></P> Thu, 13 Apr 2023 13:02:42 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639772#M16018 ricotries 2023-04-13T13:02:42Z https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639782#M16019 <P>Copy the files before uninstalling the UF.&nbsp; Replace the files after re-installing the UF and before the first run.&nbsp; It won't affect FTR.</P> Thu, 13 Apr 2023 13:44:11 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639782#M16019 richgalloway 2023-04-13T13:44:11Z https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639843#M16024 <P>Stop Splunk, delete $SPLUNK_HOME/etc/* and reinstall in the same place.</P> Thu, 13 Apr 2023 17:32:12 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-is-the-best-way-to-reinstall-a-Universal-Forwarder-without/m-p/639843#M16024 woodcock 2023-04-13T17:32:12Z