topic Can you uninstall the universal forwarder from a script? in Getting Data In

Can you uninstall the universal forwarder from a script?

juniormint — Tue, 25 Jun 2013 13:16:55 GMT

Sorry for the noob questions, but I am a Linux guy only recently forced back into the world of Windows.

What options there are for uninstall of the universal forwarder on windows?

I know you can do it via Add/Remove programs and if you happen to have the msi file then you can do it via the command line.

Is there another route to do it via command line (ie scriptable) which does not need the msi?

Do I need the original msi? or would a 5.0.3 msi work to trigger uninstall of a 5.0.0 UF?

Re: Can you uninstall the universal forwarder from a script?

linu1988 — Tue, 25 Jun 2013 15:02:27 GMT

Hello,
You can directly migrate to newer version without uninstalling the forwarder.

Below link will help you do it with the help of scripts:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/MigrateaWindowsforwarder
http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/DeployaWindowsdfviathecommandline

Hope it will help!!!

Re: Can you uninstall the universal forwarder from a script?

juniormint — Tue, 25 Jun 2013 15:54:21 GMT

Not really answers to my question, but good information. Thanks

Re: Can you uninstall the universal forwarder from a script?

adrianathome — Wed, 26 Jun 2013 03:39:03 GMT

http://technet.microsoft.com/en-us/library/cc759262(v=ws.10).aspx#BKMK_Uninstall

I haven't done it myself. Google keywords: msiexec uninstall.

Re: Can you uninstall the universal forwarder from a script?

antlefebvre — Mon, 28 Sep 2020 14:10:47 GMT

On a computer with the Universal Forwarder installed.

Click start->Run->regedit

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Edit->Find then enter splunk

In that key you will see the UninstallString. Double click and copy that value.

Click start->Run-> cmd

at cli right click and paste that value. add /qn at the end of that string to silently uninstall.

Ex. for ver 5.0.2.149561 Win7

MsiExec.exe /X{73B67D46-99DB-40C8-9E76-9F870C519257} /qn

If you want to push this remotely there are many ways. I like psexec. Google pstools to download. Example installer below. You could modify for the uninstaller. Running this in a bat file or from cli will open a new cmd prompt to uninstall. Let it finish with an exit code before closing.

start cmd /k psexec \\#ipadd# -u "domain\domainadmin" -p "password" msiexec.exe /i "\\server\SplunkForwarder\splunkforwarder-5.0.2-149561-x86-release.msi" RECEIVING_INDEXER="splunkserver:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_FWD_ENABLE=1 WINEVENTLOG_SET_ENABLE=1 AGREETOLICENSE=Yes /quiet