Getting Data In

Splunk rolls back to previous version on while upgrading


We have Splunk cluster architecture with 1 cluster master, 2 indexers, and 1 search head.
We have successfully upgraded cluster master and search head from version 7.2.0 to 8.0.1.
While upgrading indexers it gets about 80% through the file transfer then begins to roll back the install and restores it to the original state i.e. 7.2.0.
Has anyone else faced a similar situation?

0 Karma

Esteemed Legend

There is a default log file in AppData/Local/Temp/splunk.log, and you can force more logging with $ msiexec /I <splunk-MSI> /l*v <log-file>. The problem almost always ends up being that Splunk cannot write to the disk because of a permissions problem.

Here is a step-by-step solution that should always work:

Move installation file (.msi) to the `temp` folder here:
Open a command prompt (CMD) with administrative privileges and start installation with enhanced logging:
   msiexec /i c:\temp\splunk- /l*vx msiexec.log
Change the default installation folder/path in setup wizard, choose a folder other than the default program folders (C:\Program Files, C:\Program Files (x86) etc.) because of possible corporate restrictions/policies (folder permissions). Start with `Temp` again:
The setup wizard should continue and install Splunk as expected with no errors.  I am not suggesting that you run it permanently from there, but this is a good test for permissions problems.
0 Karma

Splunk Employee
Splunk Employee

Hi @sudhir7,

To troubleshoot this further, I'd recommend enabling MSI logging. Here's an example:

msiexec /l*vx msiexec.log /i splunk-8.0.1-6db836e2fb9e-x64-release.msi

Once the installation has completed, search the log for return value 3, and whatever occurs just prior is the problem.


- Jo.

0 Karma


What error messages do you see?

If this reply helps you, an upvote would be appreciated.
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!