Getting Data In

Splunk Universal Forwarder 6.4.1 and all Versions younger than 6.2 cannot be installed to 7 of our systems

Splunk Employee
Splunk Employee

 The Error Message on the screen isenter code here: "UniversalForwarder Setup ended prematurely" 

Versions older than 6.2 (e.g. 6.1.3) of Splunk Universal Forwarder and Splunk Enterprise (and other applications) can be installed without problems. 

Since SSLv3 has been disabled in our environment, the older versions do not deliver any data and cannot be used. 

As I can see in the MSI Installer log splunk has problems getting installed version: 
Action start 16:49:22: GetPreviousSettings. 
GetPreviousSettings: Error 0x80004005: Failed to get lookup product code. 
Also tried to install as administrator from CMD-Line 

Splunk Employee
Splunk Employee

Consulted Development to see if any of the keys in the branch that you had exported were in a non-standard format (as this affects the ability for the Splunk installer to complete  the installation). 

When upgrading a Universal Forwarder or Splunk Enterprise if the hexadecimal value after HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products is not 32 hexadecimal characters the Splunk installer will report an error. It performs this check as part of the upgrade.

In the example below, there is a rogue character _.


Use the Windows PowerShell to see if you have the issue:

Get-ChildItem HKLM:\SOFTWARE\Classes\Installer\Products | Where-Object { $_.Name -notmatch '\[0-9A-F]{32}$' } | Select-Object Name

Please take a backup of the key above (by exporting it to a file), then delete the branch within the registry.

If you have multiple hosts you can use the link below which can help automate the deletion process.

Ensure the existing Splunk installer is no longer running.

Development are working to make future releases of the installer work around those registry entries. 

This has been logged as a Bug:

SPL-128643 Splunk will not install if Windows' Installer's Products key contains invalid entries