Has anyone seen duplicate windows server universal forwarders after update?

[TeganDeloitte]

I have one forwarder that is showing duplicate on my Splunk server. I updated 3 forwarders to test them. It was from v4 to v5 UF. The other two were fine, the 3rd is having an issue. Over the weekend between the two "forwarders" there were 7 connections and it overloaded the license. I uninstalled via command line and reinstalled the latest forwarder. Yet again my server is showing two forwarders with unique GUIDs. Not sure how to fix, if an uninstall and reinstall doesn't work.

[beatus]

TeganDeloitte,
It sounds like you may have a permissions issue with the install. I've seen this before on windows UFs where they don't have permissions to write out a checkpoint file. This causes the UF to re-index the entire winEventLog every time it reaches the end.

These searches may point you in the right direction:

index=_internal sourcetype=splunkd NOT info (log_level="WARN" OR log_level="ERROR" OR log_level="CRIT" OR log_level="FATAL") * component=BTreeCP | top 0 host

index=_internal sourcetype=splunkd NOT info (log_level="WARN" OR log_level="ERROR" OR log_level="CRIT" OR log_level="FATAL") * component=Logger | top 0 host

index=_internal sourcetype=splunkd NOT info (log_level="WARN" OR log_level="ERROR" OR log_level="CRIT" OR log_level="FATAL") * component=BTreeCP

I'd recommend uninstalling and ensuring the entire "splunkuniversalforwarder" directory is removed or moved out of the way. Once that's clear, try reinstalling.