Hi Team, We are facing an issue with the Splunk Universal Forwarder (UF) on one of our Windows servers. In Services.msc, the Splunk service is not running, and after disabling it we are no longer able to see “Splunk” in the list of services. We manually deleted the C:\Program Files\SplunkUniversalForwarder folder, thinking it might help. Now, when we try to uninstall/reinstall/update UF using msiexec, we receive the error: > “This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package.” The installer also complains that “policies are stopping the installation or modification,” even though we are running with local Administrator/root privileges. We also noticed leftover entries in the registry and suspect there may be orphaned MSI references blocking the installation. Has anyone faced this before? What’s the best way to fully clean up old Splunk UF services, registry entries, and MSI remnants so that we can do a fresh installation? Are there recommended steps/tools from Splunk for handling corrupted or partially removed UF installations on Windows? Any guidance would be appreciated.
... View more