This topic describes how to upgrade a universal forwarder without the deployment server

From ​splunk.com​, download the universal forwarder version 9.0.0 or later and the respective .sig file. The new .sig file is available from the More​ > "Download x509 Signature" link for each universal forwarder package. Once this operation completes, you will have two files:

• ​splunkforwarder-{version}.msi

• ​splunkforwarder-{version}.msi.sig​

​Copy both files into C:\ProgramData\splunk\upgrader on your destination Windows universal forwarder machine. Once you have installed the remote upgrader, the directory C:\ProgramData\splunk\upgrader is created to receive universal forwarder packages.​

​To trigger the upgrade, run the command:

copy C:\ProgramData\splunk\upgrader/start_uf_upgrade​

​For troubleshooting, review logs in the remote upgrader home directory​. Historical data is stored in the ./history​ directory.​