topic Re: Universal Forwarder Failed to Install in Getting Data In

Universal Forwarder Failed to Install

stayawayfrom — Tue, 29 May 2012 15:59:39 GMT

Hello,

Trying to install the Splunk Universal Forwarder onto my Windows 2003 Server. I am using the Administrator account with both Domain and Local Admin privileges. The installer errors at the the very end and spits back this message to me.

Splunk Installer was unable to start Splunk Services.

Please make sure you have provided the correct username and/or password, and the user you are trying to run Splunk as has the correct privileges. Exitcode="4"

I checked and double checked the account it has pretty much full clearance to whatever it wants, is there another issue here that I am missing?

Thanks,

Re: Universal Forwarder Failed to Install

sdaniels — Tue, 29 May 2012 16:55:19 GMT

Please see this previous answer.

http://splunk-base.splunk.com/answers/49145/why-splunk-installation-fails-with-exitcode4-wrong-privileges

Re: Universal Forwarder Failed to Install

stayawayfrom — Tue, 29 May 2012 17:15:39 GMT

Yeah I saw that. I don't have any of those files in those directories. It's all clean.

Re: Universal Forwarder Failed to Install

ekost — Tue, 31 Jul 2012 20:41:32 GMT

This is a common error during an install if the account has not been granted and tested the "Permission to log on as a service" right:
Install on Windows other than Local System

I've tested it by utilizing the same credentials on another non-running (disabled or manual) service on the same host and configured 'Log on as' with the account you want to install/run Splunk under. Once the service reports successful 'Log in as service' rights have been granted, the install will proceed normally.

Re: Universal Forwarder Failed to Install

tonytfng — Mon, 12 Nov 2012 03:32:30 GMT

Same case happened to me, I can install splunk universal forwarder as local data only, I can also change the splunkforwarder to a domain admin(also local administrator) and started the service.
But I can't install splunkforwarder as Remote Windows Data with the same domain admin account.

I hope to gather windows performance metric data for analysis, mostly win srv 2008 w/sp2 or R2, is there any solution?