topic Re: Error when trying to install splunk on Windows Server 2008 in Installation

Error when trying to install splunk on Windows Server 2008

bbarkinwilkins — Sat, 26 Nov 2011 06:11:36 GMT

When we try to install splunk on a Windows Server 2008, we get this error message: "Splunk Installer was unable to create Splunk Services."

We get the same error when we try to have it run as either a local system account or as an administrator account.

Any ideas?

Re: Error when trying to install splunk on Windows Server 2008

bbarkinwilkins — Sat, 26 Nov 2011 06:42:06 GMT

Quick update: it appears this problem only occurs with verison 4.2. I tried installing 4.1 and it worked perfectly.

Re: Error when trying to install splunk on Windows Server 2008

Ed — Mon, 28 Nov 2011 17:59:12 GMT

Did the error dialog have an error code? In most cases there are two reasons why Splunk would fail to create the services:

The user credentials provided do not have permission to create the service. If it's a new account, Log On As A Service might not be granted to the account. To test, try assigning an existing service to this user. Usually this shows an error code of 1.

The Splunk service may already exist on the machine. Sometimes uninstalls will mark the service for deletion, but will not actually remove it until a reboot. Usually this shows an error code of 2.

Please let me know if either of these are the case or if it's something different.

Re: Error when trying to install splunk on Windows Server 2008

bbarkinwilkins — Tue, 29 Nov 2011 06:43:09 GMT

Thanks for the response Ed!

We received an error code of 1. But I don't think this had anything to do with the user permissions because the installation of Splunk 4.1 worked flawlessly. It was only Splunk 4.2 that did not work.

Re: Error when trying to install splunk on Windows Server 2008

bbarkinwilkins — Tue, 29 Nov 2011 06:44:01 GMT

Another update: once we had 4.1 installed, we were able to upgrade to 4.2 without a problem.

Re: Error when trying to install splunk on Windows Server 2008

Ed — Tue, 29 Nov 2011 18:21:42 GMT

Interesting. Glad you were able to get it working. If it pops up again, the MSI log and more likely the Splunk-.log in the %TEMP% folder might provide more clues. The Splunk-.log gets overwritten with each run though, so no way to travel back in time to see what happened.