How to uninstall/reinstall Universal Forwarder

[ericlew]

I have uninstalled the collector (ver. splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi) on Server 2012 R2, when I try to reinstall it I get the message "Product: UniversalForwarder -- This version of UniversalForwarder has already been installed on this computer." I uninstalled using add/remove programs, have rebooted, checked the registry for anything Splunk related and cant find anything.

any suggestions ?

Thanks, Eric

[splunkcol]

1. enter CMD as administrator
2. write the WMIC command
3. type the PRODUCT GET NAME command
4. you will see a list of all the programs installed in the operating system where the name of the Universal forwarder is "UniversalForwarder"
5. If you want to see general information about the program, you can execute the command PRODUCT WHERE NAME = "UniversalForwarder"
6. Now to uninstall the Universal forwarder use the command PRODUCT WHERE NAME = "UniversalForwarder" call uninstall (when a message appears press Y to confirm the uninstallation)

this video helped me
https://www.youtube.com/watch?v=dX2usQvNUeM

[bschwind]

I received same error. Version: splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi.
The right-click and uninstall did not work for me.

I fixed it and was able to install by deleting the following registry key. HKEY_CLASSES_ROOT\Installer\Products\C042F9A1CE44AA641A538C56CC9204B1

[vasanthmss]

Have you check the services?

[ericlew]

Yes, the uninstall removed the directory, however, I think I just fixed the issue. I right clicked on the splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi file and there was an option to Uninstall, which I selected, it looked like it actually was doing something, and I can now run through the install

thank you for your reply

[richgalloway]

Have you deleted the Splunk directory? It may be called "Splunk Universal Forwarder".