Splunk rolls back to previous version on while upgrading

[sudhir7]

We have Splunk cluster architecture with 1 cluster master, 2 indexers, and 1 search head.
We have successfully upgraded cluster master and search head from version 7.2.0 to 8.0.1.
While upgrading indexers it gets about 80% through the file transfer then begins to roll back the install and restores it to the original state i.e. 7.2.0.
Has anyone else faced a similar situation?

[woodcock]

There is a default log file in AppData/Local/Temp/splunk.log, and you can force more logging with $ msiexec /I <splunk-MSI> /l*v <log-file>. The problem almost always ends up being that Splunk cannot write to the disk because of a permissions problem.

Here is a step-by-step solution that should always work:

Move installation file (.msi) to the `temp` folder here:
   C:\Temp\splunk-7.3.1.1-7651b7244cf2-x64-release.msi
Open a command prompt (CMD) with administrative privileges and start installation with enhanced logging:
   msiexec /i c:\temp\splunk-7.3.1.1-7651b7244cf2-x64-release.msi /l*vx msiexec.log
Change the default installation folder/path in setup wizard, choose a folder other than the default program folders (C:\Program Files, C:\Program Files (x86) etc.) because of possible corporate restrictions/policies (folder permissions). Start with `Temp` again:
   C:\Temp\Splunk\
The setup wizard should continue and install Splunk as expected with no errors.  I am not suggesting that you run it permanently from there, but this is a good test for permissions problems.

[jhornsby_splunk]

Hi @sudhir7,

To troubleshoot this further, I'd recommend enabling MSI logging. Here's an example:

msiexec /l*vx msiexec.log /i splunk-8.0.1-6db836e2fb9e-x64-release.msi

Once the installation has completed, search the log for return value 3, and whatever occurs just prior is the problem.

Cheers,

- Jo.

[richgalloway]

What error messages do you see?