Getting Data In

Splunk rolls back to previous version on while upgrading

sudhir7
Explorer

We have Splunk cluster architecture with 1 cluster master, 2 indexers, and 1 search head.
We have successfully upgraded cluster master and search head from version 7.2.0 to 8.0.1.
While upgrading indexers it gets about 80% through the file transfer then begins to roll back the install and restores it to the original state i.e. 7.2.0.
Has anyone else faced a similar situation?

0 Karma

woodcock
Esteemed Legend

There is a default log file in AppData/Local/Temp/splunk.log, and you can force more logging with $ msiexec /I <splunk-MSI> /l*v <log-file>. The problem almost always ends up being that Splunk cannot write to the disk because of a permissions problem.

Here is a step-by-step solution that should always work:

Move installation file (.msi) to the `temp` folder here:
   C:\Temp\splunk-7.3.1.1-7651b7244cf2-x64-release.msi
Open a command prompt (CMD) with administrative privileges and start installation with enhanced logging:
   msiexec /i c:\temp\splunk-7.3.1.1-7651b7244cf2-x64-release.msi /l*vx msiexec.log
Change the default installation folder/path in setup wizard, choose a folder other than the default program folders (C:\Program Files, C:\Program Files (x86) etc.) because of possible corporate restrictions/policies (folder permissions). Start with `Temp` again:
   C:\Temp\Splunk\
The setup wizard should continue and install Splunk as expected with no errors.  I am not suggesting that you run it permanently from there, but this is a good test for permissions problems.
0 Karma

jhornsby_splunk
Splunk Employee
Splunk Employee

Hi @sudhir7,

To troubleshoot this further, I'd recommend enabling MSI logging. Here's an example:

msiexec /l*vx msiexec.log /i splunk-8.0.1-6db836e2fb9e-x64-release.msi

Once the installation has completed, search the log for return value 3, and whatever occurs just prior is the problem.

Cheers,

- Jo.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What error messages do you see?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...