Getting Data In

Can you uninstall the universal forwarder from a script?


Sorry for the noob questions, but I am a Linux guy only recently forced back into the world of Windows.

What options there are for uninstall of the universal forwarder on windows?

I know you can do it via Add/Remove programs and if you happen to have the msi file then you can do it via the command line.

Is there another route to do it via command line (ie scriptable) which does not need the msi?

Do I need the original msi? or would a 5.0.3 msi work to trigger uninstall of a 5.0.0 UF?

0 Karma


On a computer with the Universal Forwarder installed.

Click start->Run->regedit

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Edit->Find then enter splunk

In that key you will see the UninstallString. Double click and copy that value.

Click start->Run-> cmd

at cli right click and paste that value. add /qn at the end of that string to silently uninstall.

Ex. for ver Win7

MsiExec.exe /X{73B67D46-99DB-40C8-9E76-9F870C519257} /qn

If you want to push this remotely there are many ways. I like psexec. Google pstools to download. Example installer below. You could modify for the uninstaller. Running this in a bat file or from cli will open a new cmd prompt to uninstall. Let it finish with an exit code before closing.

start cmd /k psexec \\#ipadd# -u "domain\domainadmin" -p "password" msiexec.exe /i "\\server\SplunkForwarder\splunkforwarder-5.0.2-149561-x86-release.msi" RECEIVING_INDEXER="splunkserver:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_FWD_ENABLE=1 WINEVENTLOG_SET_ENABLE=1 AGREETOLICENSE=Yes /quiet


I haven't done it myself. Google keywords: msiexec uninstall.

0 Karma


You can directly migrate to newer version without uninstalling the forwarder.

Below link will help you do it with the help of scripts:

Hope it will help!!!

0 Karma


Not really answers to my question, but good information. Thanks

0 Karma