Universal Forwarder Failed to Install

[stayawayfrom]

Hello,

Trying to install the Splunk Universal Forwarder onto my Windows 2003 Server. I am using the Administrator account with both Domain and Local Admin privileges. The installer errors at the the very end and spits back this message to me.

Splunk Installer was unable to start Splunk Services.

Please make sure you have provided the correct username and/or password, and the user you are trying to run Splunk as has the correct privileges. Exitcode="4"

I checked and double checked the account it has pretty much full clearance to whatever it wants, is there another issue here that I am missing?

Thanks,

[tonytfng]

Same case happened to me, I can install splunk universal forwarder as local data only, I can also change the splunkforwarder to a domain admin(also local administrator) and started the service.
But I can't install splunkforwarder as Remote Windows Data with the same domain admin account.

I hope to gather windows performance metric data for analysis, mostly win srv 2008 w/sp2 or R2, is there any solution?

[ekost · Accepted solution]

This is a common error during an install if the account has not been granted and tested the "Permission to log on as a service" right:
Install on Windows other than Local System

I've tested it by utilizing the same credentials on another non-running (disabled or manual) service on the same host and configured 'Log on as' with the account you want to install/run Splunk under. Once the service reports successful 'Log in as service' rights have been granted, the install will proceed normally.

[stayawayfrom]

Yeah I saw that. I don't have any of those files in those directories. It's all clean.

[sdaniels]

Please see this previous answer.

http://splunk-base.splunk.com/answers/49145/why-splunk-installation-fails-with-exitcode4-wrong-privi...