After uninstalling a Universal Forwarder on Windows Server 2008, why am I unable to reinstall it?

[kemmlli]

Hi all,

I'm stuck with the Universal Forwarder. I uninstalled it properly, but it seems there is something else because I can't reinstall it. My registry is clean and I rebooted several times.

Anyone had to deal with it ?

Thanks in advance.

[NOUMSSI]

Hi,

I think that you have not uninstalled it very well. Try this:
Do a registry search for the word splunk. Removed any reference to splunk shared DLLs and installer keys

If it(s not working, do this:
On a computer with the Universal Forwarder installed.

Click start->Run->regedit

Navigate to HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall

Edit->Find then enter splunk

In that key you will see the UninstallString. Double click and copy that value.

Click start->Run-> cmd

at cli right click and paste that value. add /qn at the end of that string to silently uninstall.

Ex. for ver 5.0.2.149561 Win7

MsiExec.exe /X{73B67D46-99DB-40C8-9E76-9F870C519257} /qn

[kemmlli]

Hi and thanks all,

I don't find this key. I don't find anything with the word Splunk in the registry. I tried that after the uninstall according to a post.

When I uninstalled, I stop the service and uninstalled by the Control Panel.

[gyslainlatsa]

hi kemmlli,
try to do this for uninstall universal forwarder:

Uninstall the universal forwarder

To uninstall the universal forwarder, perform the following steps:

1. Use the Services MMC snap-in (Start > Administrative Tools > Services) to  stop the SplunkForwarder service.
Note: You can also stop the service from the command line with the following  command: `NET STOP SplunkForwarder`

2. Next, use the Add or Remove Programs control panel to uninstall the forwarder. On Windows 7, 8, Server 2008, and Server 2012,                      that option is available under Programs and Features.

Note: Under some circumstances, the Microsoft installer might present a reboot  prompt during the uninstall process. You can safely   ignore this request without  rebooting.

let know if this working. please forgive my english

[gyslainlatsa]

hi kemmlli,

for more information about uninstalling universal forwarders, try to follow the link below:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/DeployaWindowsdfviathecommandline