topic Re: splunk enterprise in Installation

splunk enterprise

saddam979 — Wed, 18 Aug 2021 19:55:48 GMT

Hi Team,

I am trying to install Splunk enterprise in my windows 10.

But i am getting this error as splunk enterprise setup wizard ended prematurely.

I have tried multiple time still get the same error .

Please any once can help me in this .

Thank you.

Re: splunk enterprise

shivanshu1593 — Wed, 18 Aug 2021 20:09:09 GMT

In event viewer, under applications, please check for event ids 1001 to 1017. It should give you an idea as to why the installation failed.

Re: splunk enterprise

SanjayReddy — Mon, 23 Aug 2021 04:55:30 GMT

Hi @saddam979

Have you tried running setup file with run as administartaor

try from CMD as administrator

msiexec.exe /i splunk-<...>-x64-release.msi

https://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonWindowsviathecommandline#Install_Splunk_Enterprise_from_the_command_line

Re: splunk enterprise

gcusello — Mon, 23 Aug 2021 07:24:44 GMT

Hi @saddam979,

as @SanjayReddy said, probably the problem is that yopu didn't run the setup as an administrator.

Anyway, in $SPLUNK_HOME\var\log\splunk you should find the "first_install.log" file containing all the logs of your failed installation and the other Splunk logs to understand what happened.

Ciao.

Giuseppe

Re: splunk enterprise

saddam979 — Tue, 24 Aug 2021 16:42:06 GMT

Hi @SanjayReddy

Thank you for the reply.

As per your and @gcusello suggestion.

I have tried to run the setup n CMD as admin with this command .

msiexec.exe /i splunk-<splunk-8.2.2-87344edfcdb4>-x64-release.msi

But i get the error message as "The system cannot find the file specified."

Even i have tried msiexec/i splunkfilename.msi

I get the error as " This installation could not be opened.

I have attached the pic for the reference.

@gcusello The path which you have mentioned to collect the log and investigate is not available in my system. May be because it is not getting installed in the system.

Please help with your suggestion.msiexec/i splunkfilename.msimsiexec.exe /i splunk-<splunk-8.2.2-87344edfcdb4>-x64-release.msi

Re: splunk enterprise

saddam979 — Tue, 24 Aug 2021 16:52:03 GMT

Hi @shivanshu1593 ,

Thank you for the suggestion i have checked the logs.

But not able to get the exact event ID..

I installed the Software today and checked for the failed event.

I got this :-Event ID 1552.
User Profile Service

With the description as :- User hive is loaded by another process (Registry Lock) Process name: C:\Windows\System32\SecurityHealthService.exe, PID: 13308, ProfSvc PID: 2024

Can you help me with this further in this case.

Thank you

Re: splunk enterprise

SanjayReddy — Wed, 25 Aug 2021 04:03:08 GMT

@saddam979

Thank you for your reply.

you need to mention location of the splunk msi file while running the command

exmaple
msiexec.exe /i C:\Users\Desktop\splunk-8.2.2-87344edfcdb4-x64-release.msi

Hope this helps to install the splunk on systme

Re: splunk enterprise

isoutamo — Wed, 25 Aug 2021 06:28:03 GMT

as it already said you must add full path for psi package on cmd line. I'm using this when installing e.g. UF on windows.

msiexec.exe /i <path to temp>/splunkforwarder-<XXXXX>-x64-release.msi AGREETOLICENSE=yes LAUNCHSPLUNK=no SERVICESTARTTYPE=auto /quiet /l*v install-log.txt

After that and before first start I will add TA for connecting DS and information about splunk indexers or next hops if those are e.g. IHF. All those steps must do on user which have Admin role/rights. And As @gcusello said you could find splunk logs under %SPLUNK_HOME% and installation logs is in this install-log.txt file.

r. Ismo

Re: splunk enterprise

saddam979 — Wed, 25 Aug 2021 20:04:37 GMT

Hi @SanjayReddy ,

Thank you for the suggestion.

As per your request i have run the CMD as an administrator.

File is located on my desktop.

when I run the command as : msiexec.exe /i C:\Users\Desktop\splunk-8.2.2-87344edfcdb4-x64-release.msi

It gives the error as

I get this error.

Then i checked the services for the windows installer i have started that and then used this cmd command it get this.

After pressing Okay nothing happen.

Not sure what is wrong.

Please help me in this .

Thank you.

Re: splunk enterprise

isoutamo — Thu, 26 Aug 2021 06:09:26 GMT

As it was said, you must use the full path here. You are probably missing user id on previous path? And if you look my previous post and add that debugging part to the end of command you will get more information what went wrong or what it has done.

/l*v install-log.txt

r. Ismo