Splunk Installation error - "Splunk Enterprise Setup Wizard ended prematurely"

[monteirolopes]

Hi,

I am trying to install Splunk 6.6.2 on Windows 2012 R2 x64 on disk 😧 (empty) and I getting error "Splunk Enterprise Setup Wizard ended prematurely". If I choose disk C: the installation works!

I tried some answers (https://answers.splunk.com/answers/232400/why-am-i-getting-error-splunk-enterprise-setup-wiz-2.html) but it doesn't work.

My user is admin.

Best regards,
Lopes.

[woodcock]

This is ALWAYS a permission problem. Splunk cannot write to the disk.

[monteirolopes]

I've used a local administrator and / or a domain administrator, and the problem still persists.
Can the issue be related to the disc type?

[skoelpin]

No, it's not a disk issue

[monteirolopes]

I found this log in my temp folder:

"unable to write 'random state'

e is 65537 (0x10001)

writing RSA key"

[skoelpin]

It could be a permissions issue.. You should download and run procmon and watch what happens as you try to install Splunk

[monteirolopes]

I've used a local administrator and / or a domain administrator, and the problem still persists.

[skoelpin]

A simple solution would be not to run on Windows.. You need to run procmon while installing to find out the issue

[monteirolopes]

Is there a specific keyword for the search? I running procmon but I do not understand much about processes

[skoelpin]

You should be looking for any errors that occur. If you still cant get it working, you should open a ticket with support. They will want to review your procmon logs

Please close out the question if this answered your initial question