Getting Data In

Windows msiexec install is failing...why?

phongshader1
New Member
This is the command run as  a ps1 script pushed out by Airwatch: msiexec.exe /i C:\Windows\Temp\splunk\splunkforwarder-8.0.6-152fb4b2bb96-x64-release.msi RECEIVING_INDEXER="<indexer>" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 MONITOR_PATH=“C:\Program Files\osquery\logs\osqueryd.results.log” MONITOR_PATH=“C:\ProgramData\Airwatch\UnifiedAgent\logs\” AGREETOLICENSE=Yes /quiet. It fails but Airwatch gives no clue as to why.  The script can be run from cmd prompt as admin and it executes as expected. When run from powershell cmd locally or through Airwatch this pops up on the remote endpoint.splunkmsiexec.PNGsplunkmsiexec.PNG
Has something changed in the last few days to make this happen? This install has been working for quite a while. Some windows updates?
Labels (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI &#43; Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...