topic Re: Error message during installation of Splunk 7.3.1 in Getting Data In

Error message during installation of Splunk 7.3.1

ngerosa — Thu, 08 Aug 2019 12:52:42 GMT

Hi all,
I'm trying to install Splunk 7.3.1 on my company computer but at a certain moment I receive this error:

"Error writing to file: C:\ProgramFiles|Splunk\share\splunk\search_mrsparkle\exposed\js\shim\splunk.pdf.js."
I'm administrator on this PC and I tried, with no success, to modify permission, on security tab, of the properties of the folder.

Could anyone help me?

Thank you!

Re: Error message during installation of Splunk 7.3.1

jhornsby_splunk — Thu, 08 Aug 2019 12:56:40 GMT

Hi ngerosa,

Is this an upgrade, or a fresh installation?

Cheers,

- Jo.

Re: Error message during installation of Splunk 7.3.1

ngerosa — Thu, 08 Aug 2019 13:02:03 GMT

Hi Jo,
it's first installation on this PC.

Cheers
Nicolò

Re: Error message during installation of Splunk 7.3.1

jhornsby_splunk — Thu, 08 Aug 2019 13:26:01 GMT

Hi Nicolò,

Is it the 64-bit version of Splunk Enterprise you're trying to install? What user are you trying to install it as?

Did you copy and paste that error? It doesn't look quite right...

Can you re-try installation like so:

msiexec /l*vx msiexec.log /i splunk-7.3.1-bd63e13aa157-x64-release.msi

And then search for "return value 3" in that file, and paste the 20 lines before that error?

Cheers,

- Jo.

Re: Error message during installation of Splunk 7.3.1

jhornsby_splunk — Thu, 08 Aug 2019 13:29:07 GMT

Hi again Nicolò,

Also, if Splunk is not installed, it may be worth renaming (or deleting) "C:\Program Files\Splunk" before attempting the installation.

Cheers,

- Jo.

Re: Error message during installation of Splunk 7.3.1

ngerosa — Thu, 08 Aug 2019 15:02:30 GMT

Hi Jo,
I tried to install using your command but in the msiexec.log there is no "Return value 3"; I find only "Return value 1".
The complete error is: "Error writing to file: C:\ProgramFiles|Splunk\share\splunk\search_mrsparkle\exposed\js\shim\splunk.pdf.js. Verify that you have access to that directory."

There is no folder, before installing Splunk, with "Splunk" as name.

Cheers
Nicolò

Re: Error message during installation of Splunk 7.3.1

jhornsby_splunk — Thu, 08 Aug 2019 15:07:01 GMT

Hi Nicolò,

Is it definitely saying:
C:\ProgramFiles|Splunk\share\
and not:
C:\Program Files\Splunk
?
Are you specifying a custom installation directory?

Could you let me know the results of the following PowerShell:
Get-FileHash splunk-7.3.1-bd63e13aa157-x64-release.msi

Cheers,

- Jo.

Re: Error message during installation of Splunk 7.3.1

ngerosa — Wed, 30 Sep 2020 01:40:08 GMT

Sorry Jo, I found "Return Value 3":

Property(S): OriginalDatabase = C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi
Property(S): UILevel = 5
Property(S): Preselected = 1
Property(S): CostingComplete = 1
Property(S): OutOfDiskSpace = 0
Property(S): OutOfNoRbDiskSpace = 0
Property(S): PrimaryVolumeSpaceAvailable = 0
Property(S): PrimaryVolumeSpaceRequired = 0
Property(S): PrimaryVolumeSpaceRemaining = 0
Property(S): SOURCEDIR = C:\Users\gerosan\
Property(S): SourcedirProduct = {562A3BD0-3B05-4C80-A93F-0AA1AD74E79F}
Property(S): ProductToBeRegistered = 1
MSI (s) (C8:D4) [17:04:35:885]: MainEngineThread is returning 1603
MSI (s) (C8:3C) [17:04:35:893]: User policy value 'DisableRollback' is 0
MSI (s) (C8:3C) [17:04:35:893]: Machine policy value 'DisableRollback' is 0
MSI (s) (C8:3C) [17:04:35:893]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (C8:3C) [17:04:35:894]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (C8:3C) [17:04:35:894]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (C8:3C) [17:04:35:895]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (C8:3C) [17:04:35:895]: Restoring environment variables
MSI (s) (C8:3C) [17:04:35:896]: Destroying RemoteAPI object.
MSI (s) (C8:14) [17:04:35:896]: Custom Action Manager thread ending.
MSI (c) (20:6C) [17:04:35:898]: Back from server. Return value: 1603
MSI (c) (20:6C) [17:04:35:898]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (20:6C) [17:04:35:898]: PROPERTY CHANGE: Deleting SECONDSEQUENCE property. Its current value is '1'.
Action ended 17:04:35: ExecuteAction. Return value 3

Re: Error message during installation of Splunk 7.3.1

ngerosa — Wed, 30 Sep 2020 01:40:13 GMT

Hi Jo, Sorry I find "Return Value 3":

I tried to run the command: Get-FileHash splunk-7.3.1-bd63e13aa157-x64-release.msi but the result is that this command is not recognize as internal or external command.
For the full path of the error I'm not secure that is C:\ProgramFiles|Splunk\share\ or C:\Program Files|Splunk\share\ because the message goes to new line immediatly after C:\Program

Re: Error message during installation of Splunk 7.3.1

jhornsby_splunk — Thu, 08 Aug 2019 18:14:54 GMT

Hi Nicolò,

Get-FileHash is a PowerShell cmdlet. You need to start PowerShell first; e.g., by running powershell.exe from the command prompt.

Does the log that was generated mention the file being complained about? If so, could you copy and paste what it says?

Cheers,

- Jo.

Re: Error message during installation of Splunk 7.3.1

nareshinsvu — Fri, 09 Aug 2019 04:22:10 GMT

Were you able to successfully install previous versions of Splunk on the same machine?

Did you try re-downloading the software again and install?

Re: Error message during installation of Splunk 7.3.1

ngerosa — Fri, 09 Aug 2019 08:21:33 GMT

MSI (c) (20:6C) [16:52:21:281]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi' against software restriction policy

MSI (c) (20:6C) [16:52:21:281]: SOFTWARE RESTRICTION POLICY: C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi has a digital signature

MSI (c) (20:6C) [16:52:26:078]: SOFTWARE RESTRICTION POLICY: C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi is permitted to run at the 'unrestricted' authorization level.

MSI (c) (20:6C) [16:52:26:663]: Original package ==> C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi
MSI (c) (20:6C) [16:52:26:663]: Package we're running from ==> C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi

MSI (c) (20:6C) [16:52:26:767]: Package name extracted from package path: 'splunk-7.3.1-bd63e13aa157-x64-release.msi'

MSI (c) (20:6C) [16:52:26:805]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi'.

MSI (c) (20:6C) [16:52:26:805]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi'.

MSI (s) (C8:3C) [16:52:59:022]: Running installation inside multi-package transaction C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi

Re: Error message during installation of Splunk 7.3.1

ngerosa — Fri, 09 Aug 2019 08:30:08 GMT

Hi nareshinsvu,
is first installation on this PC. Yes, I tried also with older version but with same result.

Cheers
Nicolò

Re: Error message during installation of Splunk 7.3.1

jhornsby_splunk — Fri, 09 Aug 2019 10:43:53 GMT

Hi again Nicolò,

This is really very weird. The only thing I can think of suggesting now is running Sysinternals' Process Monitor and seeing if that tells you anything. You can download it here: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

Good luck!

Cheers,

- Jo.

Re: Error message during installation of Splunk 7.3.1

woodcock — Fri, 09 Aug 2019 15:00:51 GMT

I never install splunk in Program Files because some of the paths are too long for Windows. Always install it in the root of a drive.

Re: Error message during installation of Splunk 7.3.1

nareshinsvu — Mon, 12 Aug 2019 01:22:41 GMT

Looks like some issue with your operating system (suspicion only). Did you try any other alternative options?

https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/DeployandrunSplunkEnterpriseinsideDockercontainers

Re: Error message during installation of Splunk 7.3.1

ngerosa — Mon, 12 Aug 2019 09:51:25 GMT

Hi woodcock,
I tried to install in the root of the drive but I have the same error

Re: Error message during installation of Splunk 7.3.1

ngerosa — Mon, 12 Aug 2019 09:54:08 GMT

I have not Linux OS, I have problem only with my windows laptop that I use in office.
In the past I installed Splunk on my private laptop without any problems.

Re: Error message during installation of Splunk 7.3.1

ngerosa — Mon, 12 Aug 2019 10:10:54 GMT

Hi Jo,
I installed and runned Sysinternals' Process Monitor. What, specifically, should I look for?

Re: Error message during installation of Splunk 7.3.1

jhornsby_splunk — Mon, 12 Aug 2019 11:33:29 GMT

Hi Nicolò,

I'd suggest looking for that error, and then look at the history of that file and it's parent directories. Hopefully there'll be a smoking gun there.

Cheers,

Jo.
- List item