topic Re: Uninstall universal forwarder error: "Splunk Installer was unable to enable event log monitoring. Splunk exitcode='1'" in Getting Data In

Uninstall universal forwarder error: "Splunk Installer was unable to enable event log monitoring. Splunk exitcode='1'"

maroex77 — Thu, 21 Dec 2017 18:56:40 GMT

I am trying to uninstall Universal Forwarder 6.1.3 and it gives me an error "Splunk Installer was unable to enable event log monitoring. Splunk exitcode='1'". Does anyone know how to fix this so i can remove and update to the new version?

Re: Uninstall universal forwarder error: "Splunk Installer was unable to enable event log monitoring. Splunk exitcode='1'"

p_gurav — Wed, 03 Jan 2018 04:50:41 GMT

Hi maroex77,

Please follow steps in below link to upgrade your splunk according to your system OS:
http://docs.splunk.com/Documentation/Splunk/7.0.1/Installation/HowtoupgradeSplunk

Re: Uninstall universal forwarder error: "Splunk Installer was unable to enable event log monitoring. Splunk exitcode='1'"

nikita_p — Wed, 03 Jan 2018 06:02:35 GMT

Hi @maroex77,
Did you specify a destination indexer IP with port 9997.
In the service manager you should verify that the user name and password are correct. You should use the domain\username format for the username.

Re: Uninstall universal forwarder error: "Splunk Installer was unable to enable event log monitoring. Splunk exitcode='1'"

risgupta — Wed, 03 Jan 2018 06:50:18 GMT

Try to check if the PID file is existing for the splunk at the location $SPLUNK_HOME/var/run/splunk/.

if there it is, then you can remove that file and then you can delete the entire splunk. If this still does not help you, then you might need to remove the registry settings for the splunk from HKEY_LOCAL for the windows machine.

Let me know how it goes.