Getting Data In

Can't install universal forwarder on windows server 2012 R2

New Member

When I run the MSI installer for the universal forwarder on a clean install of windows server 2012 R2, I'm getting the following error from the GUI:

UniversalForwarder setup wizard ended prematurely because of an error. Your system has not been modified. 

In the splunk.log file in the temp directory, there is only one line:

This appears to be your first time running this version of Splunk.

And in the /var/log/splunk/first_install.log file, again, there is no useful information:

VERSION=6.2.2
BUILD=255606
PRODUCT=splunk
PLATFORM=Windows-AMD64

I've enabled MSI logging and I've put the results in the gist below:

https://gist.github.com/anonymous/8b692986e99f8945a836

However I really have no idea what I'm looking for in this file. The user I'm trying to install this with is an administrator.

Labels (2)
0 Karma

New Member

I found a solution. just turn off the SplunkForwarder in "winodws service", then reinstall splunkforwarder again, you will install successfully.

0 Karma

Path Finder

I had to restart my Windows Server 2012 R2 then the install worked immediately. I have no idea why, and I don't like the solution but I'm happy it's working!

0 Karma

New Member

Windows 10
Windows Server 2016, 2019......u have installed or which one

0 Karma

Communicator

That's too risky, I have the same problem too, I'm not allowed to reboot the server and even I'm allowed to do that, I'm not gonna do it specially if the server is on the production. Is there any suggested solution for this problem?

0 Karma

Splunk Employee
Splunk Employee

@dantimola can you provide your logs?

Does the install appear to complete, then roll back from the end? or at what point does it fail?

0 Karma

Communicator

FATAL HTTPServer - Could not bind to port 8089 here's the log

0 Karma

Communicator

yes, the install almost complete, but eventually roll back from the end. Then splunk installation wizard will show a message stating that "UniversalForwarder setup wizard ended prematurely"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!