looks like others may be having similar issues..
https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Enterprise-9-1-3-Universal-Forwarder-can-t-be-updated/m-p/675236
https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Enterprise-9-1-3-Universal-Forwarder-can-t-be-updated/m-p/675236