Getting Data In

How to uninstall/reinstall Universal Forwarder

New Member

I have uninstalled the collector (ver. splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi) on Server 2012 R2, when I try to reinstall it I get the message "Product: UniversalForwarder -- This version of UniversalForwarder has already been installed on this computer." I uninstalled using add/remove programs, have rebooted, checked the registry for anything Splunk related and cant find anything.

any suggestions ?

Thanks, Eric

0 Karma


1. enter CMD as administrator
2. write the WMIC command
3. type the PRODUCT GET NAME command
4. you will see a list of all the programs installed in the operating system where the name of the Universal forwarder is "UniversalForwarder"
5. If you want to see general information about the program, you can execute the command PRODUCT WHERE NAME = "UniversalForwarder"
6. Now to uninstall the Universal forwarder use the command PRODUCT WHERE NAME = "UniversalForwarder" call uninstall (when a message appears press Y to confirm the uninstallation)

this video helped me

0 Karma


I received same error. Version: splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi.
The right-click and uninstall did not work for me.

I fixed it and was able to install by deleting the following registry key. HKEY_CLASSES_ROOT\Installer\Products\C042F9A1CE44AA641A538C56CC9204B1


Have you check the services?

0 Karma

New Member

Yes, the uninstall removed the directory, however, I think I just fixed the issue. I right clicked on the splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi file and there was an option to Uninstall, which I selected, it looked like it actually was doing something, and I can now run through the install

thank you for your reply

0 Karma


Have you deleted the Splunk directory? It may be called "Splunk Universal Forwarder".

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!