Splunk UF version 9.4.1 install issue

[christal654]

OS Version: Server 2019

I'm trying to install Splunk UF in my test lab. Using the GUI install, I put all the necessary options needed for my indexing server and the install starts rolling back during what appears to be the last step of the install. The server once had a successful install of 9.4.0. Since the uninstall, I can no longer get another version of the UF to install anymore. 

I've tried: 

-re-downloading the UF and using the "newer" download to install

-deleting the Splunk folder from c:\pro files

-restarting the VM after the failed install and starting over

-installing as "local system account" and "virtual account" -- both failed

I'm at my wits end now. 

[livehybrid]

Hi @christal654 ,

To resolve the installation rollback issue for the Splunk Universal Forwarder (UF), try the following steps:

• Remove Remaining Files and Registry Entries:
1. Ensure the Splunk folder is deleted from C:\Program Files\. (Which I believe you have done already)
2. Check for any remaining Splunk registry entries:
3. Open regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Splunk and delete the Splunk key if it exists.
4. Also check HKEY_CURRENT_USER\Software\Splunk and delete if necessary.
• Check for Pending Reboots
• Install Using Command Line:
  Sometimes, the GUI can cause issues. Try installing via command line:

msiexec /i SplunkUniversalForwarder-<version>-x64-release.msi /quiet INSTALLDIR="C:\Program Files\SplunkUniversalForwarder" 

Replace <version> with the actual version number.

• Check Installation Logs - Look at the installation log files located in the %temp% directory (e.g., msi*.log`) to identify specific errors during the installation process.

• Permissions: Ensure you have administrative privileges when running the installer.

If these steps do not resolve the issue, provide the error messages from the installation logs for further troubleshooting.

For detailed troubleshooting, refer to the Splunk documentation on installation issues: Splunk Universal Forwarder Installation.

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[christal654]

Thank you for responding to my post!

I've completed all the below recommendations to no avail. Within the registry, there were no Splunk folders. I also deleted the folders from the C Drive as well. I'm not sure what to do at this point. 

If you have anymore tips and tricks, please let me know. 

[isoutamo]

I prefer to use this command in powershell

msiexec.exe /i <path to temp>/splunkforwarder-<XXXXX>-x64-release.msi AGREETOLICENSE=yes LAUNCHSPLUNK=no SERVICESTARTTYPE=auto /quiet /l*v install-log.txt

This /l*v install-log.txt gives you more verbose  file with log messages which help you to solve issues.

Then I have separate apps which contains DS definitions and another for outputs.conf definition. Both those are also in DS and can be updated later on with DS.

After I have added those two apps, then I start SplunkFowarder service.

[christal654]

Thank you for responding. I tried that method of installing but still doesn't install. With the "/quiet" install, the command line freeze for a bit then a minute later, it still doesn't install. I cannot find out why its completing its rolling back actions. 

If you have anymore tips and tricks, please let me know. 

[isoutamo]

Have you look that installation log file? Usually there is reason why installing splunk has failed!