Uninstall the universal forwarder

Prerequisites to uninstalling the universal forwarder

Before you uninstall the forwarder, stop it and remove it from any system start-up scripts first. Run these commands from a shell or command prompt or Terminal or PowerShell window.

1. If you configured the universal forwarder to start on boot, remove it from your boot scripts before you uninstall.
   

   Unix	Windows
   cd $SPLUNK_HOME ./splunk disable boot-start	cd %SPLUNK_HOME% .\splunk disable boot-start

2. Stop the forwarder.
   

   Unix	Windows
   ./splunk stop	.\splunk stop

Uninstall the universal forwarder with your package management utilities

Use your local package management commands to uninstall the universal forwarder. Files that were not originally installed by the package will be retained. These include configuration and index files within the installation directory.

In these instructions, $SPLUNK_HOME refers to the universal forwarder installation directory. On Windows, this is C:\Program Files\SplunkUniversalForwarder by default. For most Unix platforms, the default installation directory is /opt/splunkforwarder. On Mac OS X, it is /Applications/splunkforwarder.

RedHat Linux

• Run the following command to uninstall the forwarder.
  

rpm -e splunk_product_name

Debian Linux

1. Run the following command to uninstall the forwarder.
   

   dpkg -r splunkforwarder
   

2. (Optional) Run the following command to purge all universal forwarder files, including configuration files.
   

   dpkg -P splunkforwarder
   

FreeBSD

1. Run the following command to uninstall the forwarder.
   

   pkg_delete splunkforwarder
   

2. (Optional) Run the following command to uninstall the forwarder from a different location.
   

   pkg_delete -p <location> splunkforwarder
   

Solaris

• Run the following command to uninstall the forwarder.
  

pkgrm splunkforwarder

Uninstall the universal forwarder on *nix systems manually

If you are not able to use package management commands, or you run HP-UX, use these instructions to uninstall the software manually.

1. Stop the forwarder.
   

   $SPLUNK_HOME/bin/splunk stop
   

2. Find any lingering processes that contain "splunk" in their name and use the kill to end them.
   

   Linux and Solaris	FreeBSD and Mac OS X
   kill -9 `ps -ef | grep splunk | grep -v grep | awk '{print $2;}'`	kill -9 `ps ax | grep splunk | grep -v grep | awk '{print $1;}'`

3. Remove the universal forwarder installation directory, $SPLUNK_HOME.
   

   rm -rf /opt/splunkforwarder
   

4. (Optional) On Mac OS X, use the Finder to remove the installation directory by dragging the folder into the Trash.
5. (Optional) Delete any splunk users and groups that you created, if they exist.
   

   Linux, Solaris, and FreeBSD	Mac OS X
   userdel splunk groupdel splunk	Use the System Preferences > Accounts control panel to manage users and groups.

Note: Where the service is configured to run on *nix under systemd, use the following commands:

systemctl stop splunkforwarder

systemctl disable splunkforwarder

Uninstall the Windows universal forwarder

Under some circumstances, the Microsoft installer might present a reboot prompt during the uninstall process. You can safely ignore this request without rebooting.

1. Stop the SplunkForwarder service. You have several options:
   Use a PowerShell or command prompt to stop the forwarder.

   cd  %SPLUNK_HOME%\bin
   .\splunk stop
   

   Use a PowerShell or command prompt to stop the SplunkForwarder service.

   NET STOP SplunkForwarder

   Use the Services MMC snap-in (Start > Administrative Tools > Services) to stop the SplunkForwarder service.
2. Open the Control Panel and use the Add or Remove Programs application to start the uninstallation process. On Windows 7, 8, 10, Server 2008, and Server 2012, that option is available under Programs and Features.
3. Follow the installer prompts to remove the forwarder from the Windows host.

Uninstall the Windows universal forwarder from the command line

You can also use the Services MMC snap-in (Start > Administrative Tools > Services) to stop the SplunkForwarder service.

1. Use a PowerShell window or command prompt to stop the SplunkForwarder service.
   

   cd  %SPLUNK_HOME%\bin
   .\splunk stop
   

2. Run the Microsoft Installer to perform the uninstallation.
   

   msiexec /x splunkuniversalforwarder-<...>-x86-release.msi

The installer has one supported flag that you can use during uninstallation.

Flag	Description	Default
REMOVE_FROM_GROUPS=1|0	Specifies whether or not to take away rights and administrative group membership from the user you installed the forwarder as. This flag is available only when you uninstall the universal forwarder. If you set this flag to 1, the installer takes away group membership and elevated rights from the user you installed the forwarder as. If you set this flag to 0, the installer does not take away group membership and elevated rights from the user	1 (Take away elevated rights and group membership on uninstall.)