Can't install universal forwarder on windows server 2012 R2

[JJBurgess]

When I run the MSI installer for the universal forwarder on a clean install of windows server 2012 R2, I'm getting the following error from the GUI:

UniversalForwarder setup wizard ended prematurely because of an error. Your system has not been modified. 

In the splunk.log file in the temp directory, there is only one line:

This appears to be your first time running this version of Splunk.

And in the /var/log/splunk/first_install.log file, again, there is no useful information:

VERSION=6.2.2
BUILD=255606
PRODUCT=splunk
PLATFORM=Windows-AMD64

I've enabled MSI logging and I've put the results in the gist below:

https://gist.github.com/anonymous/8b692986e99f8945a836

However I really have no idea what I'm looking for in this file. The user I'm trying to install this with is an administrator.

[pckao]

I found a solution. just turn off the SplunkForwarder in "winodws service", then reinstall splunkforwarder again, you will install successfully.

[pappjr]

I had to restart my Windows Server 2012 R2 then the install worked immediately. I have no idea why, and I don't like the solution but I'm happy it's working!

[itishree123]

Windows 10
Windows Server 2016, 2019......u have installed or which one

[dantimola]

That's too risky, I have the same problem too, I'm not allowed to reboot the server and even I'm allowed to do that, I'm not gonna do it specially if the server is on the production. Is there any suggested solution for this problem?

[brreeves_splunk]

@dantimola can you provide your logs?

Does the install appear to complete, then roll back from the end? or at what point does it fail?

[dantimola]

FATAL HTTPServer - Could not bind to port 8089 here's the log

[dantimola]

yes, the install almost complete, but eventually roll back from the end. Then splunk installation wizard will show a message stating that "UniversalForwarder setup wizard ended prematurely"