Consulted Development to see if any of the keys in the branch that you had exported were in a non-standard format (as this affects the ability for the Splunk installer to complete the installation).
When upgrading a Universal Forwarder or Splunk Enterprise if the hexadecimal value after HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products is not 32 hexadecimal characters the Splunk installer will report an error. It performs this check as part of the upgrade.
In the example below, there is a rogue character _.
Output:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\C173E5AD3336A8D3394AF65D2BB0CCE6_]
Use the Windows PowerShell to see if you have the issue:
Get-ChildItem HKLM:\SOFTWARE\Classes\Installer\Products | Where-Object { $_.Name -notmatch '\[0-9A-F]{32}$' } | Select-Object Name
Please take a backup of the key above (by exporting it to a file), then delete the branch within the registry.
If you have multiple hosts you can use the link below which can help automate the deletion process.
https://support.microsoft.com/en-gb/help/310516/how-to-add--modify--or-delete-registry-subkeys-and-v...
Ensure the existing Splunk installer is no longer running.
Development are working to make future releases of the installer work around those registry entries.
This has been logged as a Bug:
SPL-128643 Splunk will not install if Windows' Installer's Products key contains invalid entries
