topic Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated in Splunk Enterprise

Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

TheExpert — Tue, 23 Jan 2024 23:15:43 GMT

Hi all,

today I successfully updated Splunk Enterprise to 9.1.3 (from 9.1.2) on a Windows 10 22H2 Pro machine with the newest Windows updates (January 2024).

Then I wanted to update the Universal Forwarder on this machine, too. Actually, there's 9.1.2 running and everything is working fine. But updating to 9.1.3 doesn't work. Near to the end of the installation process, the installation is rolled back to 9.1.2. Before the rollback there are coming up some more windows for a very short time. And then there are more then one message windows saying, that the installation failed. You then have to click on OK in every message window to finish successfully the rollback.

I don't see why the update is failing. Does anyone have the same issue? And how did you solve this issue?

Thank you.

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

TheExpert — Tue, 23 Jan 2024 23:29:41 GMT

In the Windows event log I can see that some drivers are successfully installed by the update. And then I see these events:

01/23/2024 11:17:26 PM LogName=Application EventCode=11708 EventType=4 ComputerName=WIN10SERVER User=NOT_TRANSLATED Sid=S-1-5-21-451409098-3557801342-1863680623-1001 SidType=0 SourceName=MsiInstaller Type=Informationen RecordNumber=212304 Keywords=Klassisch TaskCategory=None OpCode=Info Message=Product: UniversalForwarder -- Installation failed.

01/23/2024 11:17:26 PM LogName=Application EventCode=1033 EventType=4 ComputerName=WIN10SERVER User=NOT_TRANSLATED Sid=S-1-5-21-451409098-3557801342-1863680623-1001 SidType=0 SourceName=MsiInstaller Type=Informationen RecordNumber=212305 Keywords=Klassisch TaskCategory=None OpCode=Info Message=Das Produkt wurde durch Windows Installer installiert. Produktname: UniversalForwarder. Produktversion: 9.1.3.0. Produktsprache: 1033. Hersteller: Splunk, Inc.. Erfolg- bzw. Fehlerstatus der Installation: 1603.

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

wcolgate_splunk — Thu, 25 Jan 2024 00:43:57 GMT

Use msiexec /i .... /l*vx logfile.txt

and look for "value 3" in that file. Just above that will show more information about the installation failure.

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

CheongKing — Thu, 25 Jan 2024 01:42:37 GMT

I am also encountering issue when I'm doing a upgrade from 9.1.2.

Coming to the end it will roll back and fail..

A fresh install works fine...

Kindly advise.

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

TheExpert — Thu, 25 Jan 2024 07:19:21 GMT

Thank you. I can confirm that an unistallation of Universal Forwarder 9.1.2 and an installation of Uinversal Forwarder 9.1.3 works without issues.

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

swaro_ck — Thu, 25 Jan 2024 12:46:44 GMT

We have exactly the same problem here. Tested today on a Windows 2016/2019 - UFW Update from 9.1.1 to 9.1.3

But a new installation is out of the question for us, as you will lose all checkpoints and a reread of all is the result.

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

kb_ama — Fri, 26 Jan 2024 07:54:56 GMT

for us the upgrade worked when we added the parameter:
USE_LOCAL_SYSTEM=1
and the service was started as Local System

when we did an uninstall of 9.1.2 and new install of 9.1.3 without the parameter the service was installed with the user NT SERVICE\SplunkForwarder

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

swaro_ck — Fri, 26 Jan 2024 08:09:44 GMT

Great, thanks, that works.

Re: Splunk Enterprise 9.1.3: Universal Forwarder can't be updated

ASierra — Mon, 26 Feb 2024 13:20:15 GMT

Mine was failing also until I added the parameter above and install went through fine.