Error message during installation of Splunk 7.3.1

[ngerosa]

Hi all,
I'm trying to install Splunk 7.3.1 on my company computer but at a certain moment I receive this error:

"Error writing to file: C:\ProgramFiles|Splunk\share\splunk\search_mrsparkle\exposed\js\shim\splunk.pdf.js."
I'm administrator on this PC and I tried, with no success, to modify permission, on security tab, of the properties of the folder.

Could anyone help me?

Thank you!

[ngerosa]

MSI (c) (20:6C) [16:52:21:281]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi' against software restriction policy

MSI (c) (20:6C) [16:52:21:281]: SOFTWARE RESTRICTION POLICY: C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi has a digital signature

MSI (c) (20:6C) [16:52:26:078]: SOFTWARE RESTRICTION POLICY: C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi is permitted to run at the 'unrestricted' authorization level.

MSI (c) (20:6C) [16:52:26:663]: Original package ==> C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi
MSI (c) (20:6C) [16:52:26:663]: Package we're running from ==> C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi

MSI (c) (20:6C) [16:52:26:767]: Package name extracted from package path: 'splunk-7.3.1-bd63e13aa157-x64-release.msi'

MSI (c) (20:6C) [16:52:26:805]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi'.

MSI (c) (20:6C) [16:52:26:805]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi'.

MSI (s) (C8:3C) [16:52:59:022]: Running installation inside multi-package transaction C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi

[jhornsby_splunk]

Hi Nicolò,

Is it definitely saying:
C:\ProgramFiles|Splunk\share\
and not:
C:\Program Files\Splunk
?
Are you specifying a custom installation directory?

Could you let me know the results of the following PowerShell:
Get-FileHash splunk-7.3.1-bd63e13aa157-x64-release.msi

Cheers,

- Jo.

[ngerosa]

Hi Jo, Sorry I find "Return Value 3":

Property(S): OriginalDatabase = C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi
Property(S): UILevel = 5
Property(S): Preselected = 1
Property(S): CostingComplete = 1
Property(S): OutOfDiskSpace = 0
Property(S): OutOfNoRbDiskSpace = 0
Property(S): PrimaryVolumeSpaceAvailable = 0
Property(S): PrimaryVolumeSpaceRequired = 0
Property(S): PrimaryVolumeSpaceRemaining = 0
Property(S): SOURCEDIR = C:\Users\gerosan\
Property(S): SourcedirProduct = {562A3BD0-3B05-4C80-A93F-0AA1AD74E79F}
Property(S): ProductToBeRegistered = 1
MSI (s) (C8:D4) [17:04:35:885]: MainEngineThread is returning 1603
MSI (s) (C8:3C) [17:04:35:893]: User policy value 'DisableRollback' is 0
MSI (s) (C8:3C) [17:04:35:893]: Machine policy value 'DisableRollback' is 0
MSI (s) (C8:3C) [17:04:35:893]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (C8:3C) [17:04:35:894]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (C8:3C) [17:04:35:894]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (C8:3C) [17:04:35:895]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (C8:3C) [17:04:35:895]: Restoring environment variables
MSI (s) (C8:3C) [17:04:35:896]: Destroying RemoteAPI object.
MSI (s) (C8:14) [17:04:35:896]: Custom Action Manager thread ending.
MSI (c) (20:6C) [17:04:35:898]: Back from server. Return value: 1603
MSI (c) (20:6C) [17:04:35:898]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (20:6C) [17:04:35:898]: PROPERTY CHANGE: Deleting SECONDSEQUENCE property. Its current value is '1'.
Action ended 17:04:35: ExecuteAction. Return value 3

I tried to run the command: Get-FileHash splunk-7.3.1-bd63e13aa157-x64-release.msi but the result is that this command is not recognize as internal or external command.
For the full path of the error I'm not secure that is C:\ProgramFiles|Splunk\share\ or C:\Program Files|Splunk\share\ because the message goes to new line immediatly after C:\Program