topic Re: Splunk Universal Forwarder Deployment with SCCM in Getting Data In

Splunk Universal Forwarder Deployment with SCCM

asofo — Wed, 04 Nov 2015 13:28:26 GMT

Hello,

We are trying to deploy the Splunk Universal Forwarder using Microsoft SCCM. I can successfully install the MSI from the command line using:

msiexec /i "splunkforwarder-6.3.0-aa7d4b1ccb80-x64-release.msi" AGREETOLICENSE=Yes DEPLOYMENT_SERVER="mydeploymentserver:8089" /quiet

However when our SCCM admin uses the same command in his deployment manager, the installation fails. According to the SCCM log, the error is:

[LOG[Failed to clear product> advertisement, error code> 1603]LOG]!> date="10-29-2015" component="execmgr"> context="" type="3" thread="17300"> file="msiexecution.cpp:264"

I know this is most likely an SCCM issue, but wanted to see if anyone out there has received a similar error or had a similar issue.

Thanks!

Re: Splunk Universal Forwarder Deployment with SCCM

bohanlon_splunk — Wed, 04 Nov 2015 14:29:07 GMT

Sounds like this:
https://support.microsoft.com/en-us/kb/834484

Re: Splunk Universal Forwarder Deployment with SCCM

asofo — Wed, 04 Nov 2015 16:58:34 GMT

I saw that earlier, but the machines are Windows 7 and I checked all permissions. The weird thing is that there weren't any problems with the 6.0.1 version of the Universal Forwarder.

Re: Splunk Universal Forwarder Deployment with SCCM

shartwell — Fri, 06 Nov 2015 00:04:56 GMT

Could be the "/q" switch SCCM adds to packages when it deploys them.
Splunk already has a "/quiet" switch and the two together will prevent SCCM from deploying it.
You'll need to create a batch file which executes the MSI to get around this problem.