topic Re: Upgrade Splunk Universal forwarder ? in Installation

Upgrade Splunk Universal forwarder ?

AaronMoorcroft — Tue, 16 Apr 2013 08:42:30 GMT

Hi Guys

Im a little confused, I need to upgrade what I believe is a Splunk universal forwarder, I think this as its located "C:\program files\SplunkUniversalForwarder" build version is below -

VERSION=4.3.2
BUILD=123586
PRODUCT=splunk
PLATFORM=Windows-AMD64

This is installed on a 2008 R2 64bit box, my issue is that when trying to upgrade with SplunkFprwarder-5.0.2-149561-x64-release

the upgrade seems to get about halfway though but then fails with this error -

Splunk Launcher - Splunk could not start splunks first time run - Error Code - 1

Im installing as a domain admin so its not related to privlidges, the other issue I see is that the only service that is running is called Splunk Forwarder, there are no other Splunk services installed from what I can see, I dont know if thatts an issue ?

any ideas guys ?

Re: Upgrade Splunk Universal forwarder ?

AaronMoorcroft — Tue, 16 Apr 2013 09:11:27 GMT

Another thing that I noticed is that when upgrading Im asked questions such as the deployment servers details and forwarders details IP's even what logs I would like to monitor, on other machines with the upgrade it just installs without being prompted for this info.

Re: Upgrade Splunk Universal forwarder ?

AaronMoorcroft — Tue, 16 Apr 2013 09:27:03 GMT

EDIT --- exact error message is -

Splunk Installer was unable to launch Splunks first time run - Error Code 1

Re: Upgrade Splunk Universal forwarder ?

AaronMoorcroft — Tue, 16 Apr 2013 11:09:21 GMT

OK I have sorted it -

I ended up deleting the service from services, this was named SplunkForwarder ( it was the only Splunk service listed), of course it didnt go smoothly and there was an error to state that the service didnt exist, I then tried to restart the said service only to get yet another error.

I then ran the upgrade again which then got 1 step further but failed again but with another error stating that Splunk couldnt create a service, I then rebooted and ran the installer again and low and behold it installed without issue.

Re: Upgrade Splunk Universal forwarder ?

wbfoxii — Wed, 10 Jul 2013 17:33:14 GMT

This was a good tip. I had the same trouble installing v5.0.3 over v5.0.2. I stopped the service, then used a domain admin account to do the install. I did not have to reboot.

Re: Upgrade Splunk Universal forwarder ?

AaronMoorcroft — Thu, 11 Jul 2013 08:13:34 GMT

Pleased I could help 🙂

Please give the tick box a tick to mark as an answer.