When I run the MSI installer for the universal forwarder on a clean install of windows server 2012 R2, I'm getting the following error from the GUI:
UniversalForwarder setup wizard ended prematurely because of an error. Your system has not been modified.
In the splunk.log file in the temp directory, there is only one line:
This appears to be your first time running this version of Splunk.
And in the /var/log/splunk/first_install.log file, again, there is no useful information:
VERSION=6.2.2 BUILD=255606 PRODUCT=splunk PLATFORM=Windows-AMD64
I've enabled MSI logging and I've put the results in the gist below:
However I really have no idea what I'm looking for in this file. The user I'm trying to install this with is an administrator.
That's too risky, I have the same problem too, I'm not allowed to reboot the server and even I'm allowed to do that, I'm not gonna do it specially if the server is on the production. Is there any suggested solution for this problem?
yes, the install almost complete, but eventually roll back from the end. Then splunk installation wizard will show a message stating that "UniversalForwarder setup wizard ended prematurely"