I have two splunk installation in this server. I see that both are running based on splunkd processed. When I try to stop one of the (forwarder) it fails to stop. No error messages anywhere that I can find. Only a warning about splunk_home being set, which seems unrelated.
The indexer is running on port 42200. Because it has child processes that are running searches, that instance is the indexer. It is running as process id 21156 and subprocesses.
The forwarder is running as process id 8494 on port 9779. It also has subprocesses.
You have an environment variable ($SPLUNK_HOME) set. The message that you get is simply pointing out that Splunk is ignoring the environment variable (which is good, because $SPLUNK_HOME is pointing to the indexer, not the forwarder.)
su - sfdc
And if that didn't work, I would ensure that all files belong to sfdc