topic Re: permission problem on windows with etc\system\metadata\default.meta in Getting Data In

permission problem on windows with etc\system\metadata\default.meta

mataharry — Tue, 19 Nov 2013 21:35:31 GMT

I installed Splunk Universal forwarder on Windows (2008 rc2), but when I tried to upgrade or to uninstall, it failed.

Error 1321. The Installer has insufficient privileges to modify the file D:\Program Files\SplunkUniversalForwarder\etc\system\metadata\default.meta

It seems to be linked to the MSI installer.
I checked the file it's locked, and there are no visible owner or permissions, even windows doesn't know how to display it.

Re: permission problem on windows with etc\system\metadata\default.meta

yannK — Tue, 19 Nov 2013 21:36:58 GMT

There is a workaround to fix the file permissions :

Manually updates the permissions of the $Splunk$\etc\system\metadata folder prior to upgrading/uninstall the forwarder. Set the folder to "Inherit Permissions from Parent", and after upgrade, the default.meta file was not corrupt.

Re: permission problem on windows with etc\system\metadata\default.meta

mataharry — Tue, 19 Nov 2013 21:37:54 GMT

It worked. I still don't know what causes that. Is is only with MSI installer on the command line ?

Re: permission problem on windows with etc\system\metadata\default.meta

yannK — Mon, 25 Nov 2013 18:07:21 GMT

If you have a broken instance on the latest version (6.0 currently), and want to fix it without uninstalling, here is a workaround :

previous state : splunkforwarder version 6 with the permission issue

stop the splunkforwarder service
change recursively the owner of the folder $SPLUNK_HOME\etc\system to your user or the system
repair the install using the MSI command line for the same version 6.0 msiexec /fa splunkforwarder-6.0-*.msi