What is the best way to reinstall a Universal Forwarder without reindexing events?

[ricotries]

I have run into some cases where the best path forward was to reinstall a Universal Forwarder and point them to a Deployment Server to have a clean set of configurations. The problem is that if the same paths are monitored after the reinstallation, events could be reindexed. I know that I could potentially make a backup of the $SPLUNK_HOME/var/lib/splunk/fishbucket/ before uninstallation and place it on the new UF (Solved: How can I prevent reindexing events after a reinst... - Splunk Community), but when I read some of the data in these files, I see references to the GUID of the current instance of the UF. Wouldn't this create a conflict with the new GUID generated for the new instance of the UF? How does Splunk treat this inconsistency?

[woodcock]

Stop Splunk, delete $SPLUNK_HOME/etc/* and reinstall in the same place.

[richgalloway · Accepted solution]

You can preserve the GUID by copying $SPLUNK_HOME/etc/instance.cfg and restoring it after the re-installation of the UF.

[ricotries]

@richgalloway, should I copy $SPLUNK_HOME/etc/instance.cfg and $SPLUNK_HOME/var/lib/splunk/fishbucket/ before or after the first run? I'd think it should be done before, but wouldn't that mess up with the first run executions?

[richgalloway]

Copy the files before uninstalling the UF.  Replace the files after re-installing the UF and before the first run.  It won't affect FTR.