Reinstall Splunk Universal Forwarder

[hectorvp]

Hi Splunkers,

I need to uninstall existing UF and re install new UF (sounds weird, but I have such case) without allowing to re index  past data again?

Is this possible?

Need to run new UF as if it wasn't installed newly but is the same one, care of conf files can be taken.

[richgalloway]

Please describe the problem you're trying to solve by re-installing the UF.

In theory, it should be possible to retain the file positions by the saving the fishbucket, but I'm not sure if a freshly-installed UF would be confused by that.

[hectorvp]

Hi @richgalloway ,

We need to take a control over existing prod servers where UFs are installed by certain vendor, since vendor has been decommissioned, we are told to reinstall UF by uninstalling previous one(with new admin pwd and forwarder license), but since indexers are going to be same and nothing is going to be changed in indexers, there is possibility of getting events reindexed.  Need to avoid it. Reusing same UF may cause forwarder license owning issue.

[richgalloway]

There is no such thing as a "forwarder license owning issue".  All universal forwarders have the same license, which has no ownership (except perhaps by Splunk).

Changing the admin password is a good idea.  Good instructions for resetting the password can be found at https://www.hurricanelabs.com/splunk-tutorials/splunk-7-1-performing-a-splunk-password-reset