Getting Data In

After uninstalling a Universal Forwarder on Windows Server 2008, why am I unable to reinstall it?


Hi all,

I'm stuck with the Universal Forwarder. I uninstalled it properly, but it seems there is something else because I can't reinstall it. My registry is clean and I rebooted several times.

Anyone had to deal with it ?

Thanks in advance.

0 Karma



I think that you have not uninstalled it very well. Try this:
Do a registry search for the word splunk. Removed any reference to splunk shared DLLs and installer keys

If it(s not working, do this:
On a computer with the Universal Forwarder installed.

Click start->Run->regedit

Navigate to HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall

Edit->Find then enter splunk

In that key you will see the UninstallString. Double click and copy that value.

Click start->Run-> cmd

at cli right click and paste that value. add /qn at the end of that string to silently uninstall.

Ex. for ver Win7

MsiExec.exe /X{73B67D46-99DB-40C8-9E76-9F870C519257} /qn


Hi and thanks all,

I don't find this key. I don't find anything with the word Splunk in the registry. I tried that after the uninstall according to a post.

When I uninstalled, I stop the service and uninstalled by the Control Panel.

0 Karma


hi kemmlli,
try to do this for uninstall universal forwarder:

Uninstall the universal forwarder

To uninstall the universal forwarder, perform the following steps:

1. Use the Services MMC snap-in (Start > Administrative Tools > Services) to  stop the SplunkForwarder service.
Note: You can also stop the service from the command line with the following  command: `NET STOP SplunkForwarder`

2. Next, use the Add or Remove Programs control panel to uninstall the forwarder. On Windows 7, 8, Server 2008, and Server 2012,                      that option is available under Programs and Features.

Note: Under some circumstances, the Microsoft installer might present a reboot  prompt during the uninstall process. You can safely   ignore this request without  rebooting.

let know if this working. please forgive my english

0 Karma


hi kemmlli,

for more information about uninstalling universal forwarders, try to follow the link below:

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...