topic Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64? in Getting Data In

Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

avinashb — Tue, 28 Apr 2015 20:57:36 GMT

Hi,

I was trying to do a fresh install of Splunk Enterprise(splunk-6.2.2-255606-x64-release) on Windows 2012 R2 Standard x64,
As per the instruction manual, i have created users, groups, computers, group policy etc all that is required and then tried to install Splunk Enterprise as a domain account, but i keep getting the error as in below screenshot ("Splunk Enterprise Setup Wizard ended prematurely").
I am also attaching my log for your reference.
Any idea what might be causing this ?

Error Image Link - https://www.dropbox.com/s/ffkv453d1e8i76o/Splunk%20Error.jpg?dl=0
Log File Link - https://www.dropbox.com/s/lh6hbn784mje7rc/splunk.log?dl=0

System Information

 Operating System: Windows Server 2012 R2 Standard 64-bit
       Language: English (Regional Setting: English)

System Manufacturer: Dell Inc.
System Model: XPS 8700
Processor: Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz (8 CPUs), ~3.6GHz
Memory: 16384MB RAM
Available OS Memory: 16336MB RAM

Display Memory: 256 MB

Thanks,
Avi.

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

retter — Tue, 28 Apr 2015 21:14:12 GMT

Try prefixing the domain account with your domain NetBIOS name

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

avinashb — Thu, 30 Apr 2015 12:19:16 GMT

Hello Ritter,
I did that, but still keep getting same error while performing the installation.

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

avinashb — Sun, 03 May 2015 19:38:05 GMT

As per the earlier log file i found there was a error "unable to write random state e is 65537 (0x10001)", i fixed it by modifying my randfile environment variables and then tried a re-install but still installation was not successful.
This time around the log file had no errors related to random state but it appeared to be a upgrade rather than fresh installation, so i tried checking my programs list to uninstall any splunk that got installed and found nothing but i did find some installation files stored in the "Program Files" folder, can i jus delete them and try installation. (the files have been listed below for reference)

C:\Program Files
Splunk
etc
Python-2.7
share
var

As per this "http://answers.splunk.com/answers/42112/splunk-install-error-on-windows.html" i tried deleting the two splunk services but keep getting the error that none of these services exist.

So now how do i delete these existing splunk installation files ?
Is there anything else i need to take care before doing the fresh installation to make sure the error for which this topic was started wouldn't happen ?

Thank You.

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

butterslol — Fri, 15 May 2015 00:48:00 GMT

Hi I was also getting these errors, but I managed to resolve it by running the .msi as an Administrator.

Give that a go, either add your user account to the computer's local administrators group, or open a powershell as administrator and run

msiexec <splunk installer filename>.msi

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

avinashb — Fri, 15 May 2015 01:01:24 GMT

Hello butterslol,

Thank you for the reply.

I did try running the .msi as an administrator, tried with domain admin account as well as local admin account but still no luck 😞 .......

Do let me know anyother options u want me to try.....

Thanks,
Avi.

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

molinarf — Tue, 09 Jun 2015 23:57:16 GMT

I am currently experiencing the same problem. I have done the same things that Avi tried, but no luck. I am installing using a service account that has domain administrator privileges.

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

molinarf — Wed, 10 Jun 2015 00:23:07 GMT

Not sure if this will answer your question as this is what I did.

Avi -

I installed the previous version 6.1.2-213098-x64. What I noticed was that when you were doing a custom installation and it asks you if you want to use a local account or another, if you select other it will show you when you enter the user's name it has to follow this format:

Domain\username.

When installing and you reach that point, you may want to use that format.

Give it a try. As for me, installing the previous version which installed properly allowed me to then upgrade to version 6.2.3-264376-x64.

Good Luck

Robert

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

ewicher — Wed, 10 Jun 2015 06:31:34 GMT

Hi!
I had the same problem and I solved it by installing splunk under local account and afterwards I changed the owner of the whole splunk directory as well as the account the splunkd service is started as to the domain user. Works for my without problems.

Hope this helps!

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

sdinh — Tue, 08 Dec 2015 16:42:57 GMT

This had been troubling me for a while, there was no right click 'Run as administrator' option for me.

I resolved this by running CMD as Administrator, then launching the installer from within CMD!

Worked a treat! Hope this helps.

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

htidore — Sat, 17 Jun 2017 14:28:06 GMT

I had the same problem on Windows 2012 and solved it by doing the following:
1. Open Command Prompt as Administrator and Run msiexec /i splunkfilename.msi

2. Enter username in the form of Domain\username

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

JDeonarain — Tue, 05 Dec 2017 16:14:13 GMT

Worked like a charm- thanks!

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

Blinda101 — Tue, 27 Nov 2018 09:31:25 GMT

Yes. Using Domain\username Worked for me.
Thanks molinarf

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk 6.2.2 -255606-x64 on Windows 2012 R2 x64?

vriestimo — Tue, 14 May 2019 10:00:58 GMT

Entering a username with a backslash in it indeed solves the issue.

Re: Why am I getting error "Splunk Enterprise Setup Wizard ended prematurely" trying a fresh install of Splunk

santosh_sshanbh — Thu, 24 Mar 2022 11:24:28 GMT

I am also facing the same problem on newly setup VM's running Windows 2019. Tried all the options suggested here but no success.