- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Can you uninstall the universal forwarder from a s...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you uninstall the universal forwarder from a script?
Sorry for the noob questions, but I am a Linux guy only recently forced back into the world of Windows.
What options there are for uninstall of the universal forwarder on windows?
I know you can do it via Add/Remove programs and if you happen to have the msi file then you can do it via the command line.
Is there another route to do it via command line (ie scriptable) which does not need the msi?
Do I need the original msi? or would a 5.0.3 msi work to trigger uninstall of a 5.0.0 UF?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On a computer with the Universal Forwarder installed.
Click start->Run->regedit
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Edit->Find then enter splunk
In that key you will see the UninstallString. Double click and copy that value.
Click start->Run-> cmd
at cli right click and paste that value. add /qn at the end of that string to silently uninstall.
Ex. for ver 5.0.2.149561 Win7
MsiExec.exe /X{73B67D46-99DB-40C8-9E76-9F870C519257} /qn
If you want to push this remotely there are many ways. I like psexec. Google pstools to download. Example installer below. You could modify for the uninstaller. Running this in a bat file or from cli will open a new cmd prompt to uninstall. Let it finish with an exit code before closing.
start cmd /k psexec \\#ipadd# -u "domain\domainadmin" -p "password" msiexec.exe /i "\\server\SplunkForwarder\splunkforwarder-5.0.2-149561-x86-release.msi" RECEIVING_INDEXER="splunkserver:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_FWD_ENABLE=1 WINEVENTLOG_SET_ENABLE=1 AGREETOLICENSE=Yes /quiet
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
http://technet.microsoft.com/en-us/library/cc759262(v=ws.10).aspx#BKMK_Uninstall
I haven't done it myself. Google keywords: msiexec uninstall.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
You can directly migrate to newer version without uninstalling the forwarder.
Below link will help you do it with the help of scripts:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/MigrateaWindowsforwarder
http://docs.splunk.com/Documentation/Splunk/5.0.3/Deploy/DeployaWindowsdfviathecommandline
Hope it will help!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not really answers to my question, but good information. Thanks
New in Observability Cloud - Explicit Bucket Histograms
Updated Team Landing Page in Splunk Observability
New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...
