All Apps and Add-ons

How to automate Universal Forwarder msi install issue INSTALLDIR?

Ericsaccount1
Explorer

Hello, I am trying to automate a msi install for Universal Forwarder 9.0.4

I can not get this to run with the INSTALLDIR in it. If I remove INSTALLDIR, the msi runs with no issues and installs to the default location. Every time I add the INSTALLDIR to the install windows will throw up the generic msi box. Per the documents this should work unless I am missing something? I am running this as an admin

 https://docs.splunk.com/Documentation/Forwarder/9.0.4/Forwarder/InstallaWindowsuniversalforwarderfro...

 

msiexec.exe /i "splunkforwarder-9.0.4-de405f4a7979-x64-release.msi" INSTALLDIR="e:\Program Files\SplunkUniversalForwarder" AGREETOLICENSE="Yes" WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 WINEVENTLOG_FWD_ENABLE=1 WINEVENTLOG_SET_ENABLE=1 PERFMON=cpu,memory,network,diskspace SPLUNKUSERNAME=splunk SPLUNKPASSWORD="secret" /quiet

 

Labels (2)

isoutamo
SplunkTrust
SplunkTrust

Hi

you have unknown parameter INSTALLDIR. Docs didn't know it. You could try to use TARGETDIR like https://learn.microsoft.com/en-us/windows/win32/msi/targetdir told.

One easy way to check why msiexe installation fails it add "/L*V <path to log file>" to get more logs.

r. Ismo

0 Karma

Ericsaccount1
Explorer

When looking at the log I noticed all the parameters (below). I am thinking the some install parameters were missed by Splunk when the MSI Was created

 

Property(S): AdminProperties = AGREETOLICENSE;
CERTFILE;CERTPASSWORD;CLONEPREP;DEPLOYMENT_SERVER;DoNotInstallDrivers;ENABLEADMON;FAILCA;
FORCEINSTALLDRIVERS;KEEPSPLUNKHOME;LAUNCHSPLUNK;LOGON_PASSWORD;LOGON_USERNAME;MINPASSWORDDIGITLEN;MINPASSWORDLEN;
MINPASSWORDLOWERCASELEN;MINPASSWORDSPECIALCHARLEN;MINPASSWORDUPPERCASELEN;MONITOR_PATH;NEWERVERSIONDETECTED;os_OK;
OtherSplunkProductsPresent;PERFMON;PREVPRODUCTCODE;RECEIVING_INDEXER;ROOTCACERTFILE;SameProdCodeExists;SERVICESTARTTYPE;SET_ADMIN_USER;
SetSplunkPassword;SetupCertData;SetupServiceConfig;SPLUNKD_PORT;SPLUNKPASSWORD;SPLUNKUSERNAME;UIAdmon;UIApplicationLog;UICertFile;UICertPassword;
UIConfirmCertPassword;UIConfirmDomainPassword;UIDeplSrv;UIDeplSrvPort;UIDomainAccount;UIDomainPassword;UIForwardedEventsLog;UIMonPath;UINoDeplSrvOrIndexer;
UIPerfCpu;UIPerfDisk;UIPerfMemory;UIPerfNetstat;UIRecvIdx;UIRecvIdxPort;UIRootCertFile;UISecurityLog;UISetupLog;UISplunkPassword;UISplunkPasswordConfirm;
UISplunkPasswordInvalid;UISplunkUsername;UISplunkUsernameInvalid;UISystemLog;ValidatePassword;WINEVENTLOG_APP_ENABLE;WINEVENTLOG_FWD_ENABLE;WINEVENTLOG_SEC_ENABLE;
WINEVENTLOG_SET_ENABLE;WINEVENTLOG_SYS_ENABLE

Property(S): SecureCustomProperties = ARPNOMODIFY;NEWERVERSIONDETECTED;PREVPRODUCTCODE

Property(S): MsiHiddenProperties = CopyCerts;GenRandomPassword;LOGON_PASSWORD;SetSplunkPassword;SetupCert;SetupCertData
;SetupServiceConfig;SPLUNKPASSWORD;SPLUNKUSERNAME;UICertPassword;UIConfirmCertPassword;UIConfirmDomainPassword;UIDomainPassword
;UISplunkPassword;UISplunkPasswordConfirm;UISplunkUsername;ValidatePassword

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I think that those are splunk specific parameters in log. Then there are those common for all installation. Please try to change INSTALLDIR to TARGETDIR and then report if it works or not, so other people will also know that.

0 Karma

Ericsaccount1
Explorer

I have tired both INSTALLDIR and TARGETDIR with same results. If I remove them the command will  run with on issues. 

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...