Getting Data In

How to uninstall/reinstall Universal Forwarder

New Member

I have uninstalled the collector (ver. splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi) on Server 2012 R2, when I try to reinstall it I get the message "Product: UniversalForwarder -- This version of UniversalForwarder has already been installed on this computer." I uninstalled using add/remove programs, have rebooted, checked the registry for anything Splunk related and cant find anything.

any suggestions ?

Thanks, Eric

0 Karma


1. enter CMD as administrator
2. write the WMIC command
3. type the PRODUCT GET NAME command
4. you will see a list of all the programs installed in the operating system where the name of the Universal forwarder is "UniversalForwarder"
5. If you want to see general information about the program, you can execute the command PRODUCT WHERE NAME = "UniversalForwarder"
6. Now to uninstall the Universal forwarder use the command PRODUCT WHERE NAME = "UniversalForwarder" call uninstall (when a message appears press Y to confirm the uninstallation)

this video helped me

0 Karma


I received same error. Version: splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi.
The right-click and uninstall did not work for me.

I fixed it and was able to install by deleting the following registry key. HKEY_CLASSES_ROOT\Installer\Products\C042F9A1CE44AA641A538C56CC9204B1


Have you check the services?

0 Karma

New Member

Yes, the uninstall removed the directory, however, I think I just fixed the issue. I right clicked on the splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi file and there was an option to Uninstall, which I selected, it looked like it actually was doing something, and I can now run through the install

thank you for your reply

0 Karma


Have you deleted the Splunk directory? It may be called "Splunk Universal Forwarder".

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...