I have tried that, but with the same result. I did it as root here just to illustrate that it's most likely not a permissions-problem.
test30:/opt/splunkforwarder/var/log/splunk> su splunk -c /opt/splunkforwarder/bin/splunk stop
Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
Could not kill pid 13238426.
I would also add that the same thing happens when using the System Resource Controller directly
test30:/opt/splunkforwarder/var/log/splunk> stopsrc -s splunkd
0513-004 The Subsystem or Group, splunkd, is currently inoperative.
... View more