Splunk® Universal Forwarder

Forwarder Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of Splunk® Universal Forwarder. Click here for the latest version.
Acrobat logo Download topic as PDF

Stop the universal forwarder

You must stop the universal forwarder if you do not want it to forward data any more, or as part of a restart sequence when you make a configuration change that requires a restart.

The following commands use environment variables that might not be automatically set on your host. The environment variables represent where the universal forwarder has been installed on the host. To learn how to set these environment variables, see Change default values in the Admin Manual.

To learn how to start or restart the universal forwarder, see Start the universal forwarder.

  • Run the following commands to stop the universal forwarder.
    Unix Windows
    cd $SPLUNK_HOME/bin
    ./splunk stop
    cd %SPLUNK_HOME%\bin
    .\splunk stop
  • Last modified on 29 March, 2022
    Start the universal forwarder
    Configure the universal forwarder

    This documentation applies to the following versions of Splunk® Universal Forwarder:, 8.2.4, 8.2.5

    Was this documentation topic helpful?

    You must be logged into splunk.com in order to post comments. Log in now.

    Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

    0 out of 1000 Characters