topic Re: Rollback during Installation Windows 64 bit in Splunk Dev

Why rollback during Installation Windows 64 bit?

afez89 — Wed, 02 Aug 2023 19:19:35 GMT

Hi Splunk,

I have trouble installing your software.
It goes into rollback stating an error detected but no mention of the error
I selected the Windows 64 bit version.

Please advice

Thanks and regards

Re: Rollback during Installation Windows 64 bit

woodcock — Sat, 03 Jun 2017 16:26:17 GMT

Every time that this has happened it has been a permissions problem. Either you are not an admin or you cannot write into Program Files to add Splunk. You can get more debug output like this:

https://answers.splunk.com/answers/1393/does-splunk-windows-installer-generates-any-logs-during-the-install-process.html

Re: Rollback during Installation Windows 64 bit

rajatban — Tue, 29 Sep 2020 16:54:06 GMT

I am facing the same issue, i am the admin of my system, tried to install multiple times but it rollsback,
Can some one guide me "or you cannot write Program Files to add Splunk" means and how can it be resolved
It rolls back at very last of the installation process, almost after 90-95% of completion

Log file details
11-19-2017 01:51:41.318 +0530 INFO loader - Running utility: "validatedb"
11-19-2017 01:51:41.490 +0530 INFO loader - Getting configuration data from: D:\etc\myinstall\splunkd.xml
11-19-2017 01:51:41.492 +0530 INFO loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to D:\etc\modules
11-19-2017 01:51:41.493 +0530 INFO loader - loading modules from D:\etc\modules
11-19-2017 01:51:41.603 +0530 INFO loader - Writing out composite configuration file: D:\var\run\splunk\composite.xml
11-19-2017 01:51:41.743 +0530 INFO loader - Validated 8 indexes in 94.00 milliseconds
11-19-2017 01:51:43.009 +0530 INFO ServerConfig - Found no hostname options in server.conf. Will attempt to use default for now.
11-19-2017 01:51:43.010 +0530 INFO ServerConfig - Host name option is "".
11-19-2017 01:51:55.444 +0530 INFO loader - Running utility: "check-transforms-keys"
11-19-2017 01:51:55.451 +0530 INFO loader - Getting configuration data from: D:\etc\myinstall\splunkd.xml
11-19-2017 01:51:55.453 +0530 INFO loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to D:\etc\modules
11-19-2017 01:51:55.454 +0530 INFO loader - loading modules from D:\etc\modules
11-19-2017 01:51:55.494 +0530 INFO loader - Writing out composite configuration file: D:\var\run\splunk\composite.xml

Re: Rollback during Installation Windows 64 bit

dkcampbell — Wed, 24 Oct 2018 07:41:31 GMT

I have the same issue, any new information about this when the user is already admin?,I'm having the same issue, any new information regarding this issue when you are an admin?

Re: Rollback during Installation Windows 64 bit

mlog — Fri, 11 Jan 2019 19:30:42 GMT

I have the same problem in the latest version. Can anyone help?

Re: Rollback during Installation Windows 64 bit

nemri1 — Mon, 23 Nov 2020 10:39:24 GMT

Hello,

You should stop the splunk forwarder service.

then install the new agent by cmd line <msiexec.exe /i splunkuniversalforwarder.msi >

Re: Rollback during Installation Windows 64 bit

Gregski11 — Wed, 02 Aug 2023 01:10:30 GMT

same problem six years later attempting to upgrade from version 9.0.0 to 9.1.1 on half of our servers it upgraded fine on the other half it chokes

Rollback: StopSplunkServiceDef
MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=StopSplunkServiceDef,,)
Rollback: RestartSplunkService
MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=RestartSplunkService,,)
MSI (s) (B4:98) [22:00:59:416]: Executing op: CustomActionRollback(Action=RestartSplunkService,ActionType=1281,Source=BinaryData,Target=StartSplunkServiceCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;SplunkSvcName=Splunkd;LaunchSplunk=1;FailCA=)
MSI (s) (B4:BC) [22:00:59:478]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIDCBF.tmp, Entrypoint: StartSplunkServiceCA
StartSplunkService: Warning: Invalid property ignored: FailCA=.
StartSplunkService: Info: Properties: splunkHome: C:\Program Files\Splunk, svcName: Splunkd, launch splunk: 1.
StartSplunkService: Info: Enter.
StartSplunkService: Info: service Splunkd already exists
StartSplunkService: Info: Leave.
StartSplunkService: Info: Enter. Args: "C:\Program Files\Splunk\bin\splunk.exe", start --answer-yes --no-prompt --accept-license --auto-ports
StartSplunkService: Info: SystemPath is: C:\Windows\system32\
StartSplunkService: Info: Execute string: C:\Windows\system32\cmd.exe /c ""C:\Program Files\Splunk\bin\splunk.exe" start --answer-yes --no-prompt --accept-license --auto-ports >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1"
StartSplunkService: Info: WaitForSingleObject returned : 0x0
StartSplunkService: Info: Exit code for process : 0x1
StartSplunkService: Info: Leave.
StartSplunkService: Error: ExecCmd failed: 0x1.
StartSplunkService: Error 0x80004005: Cannot start splunkd service.
CustomAction RestartSplunkService returned actual error code 1603 but will be translated to success due to continue marking
Rollback: Updating component registration