Hi there,
do you have any idea ?
Splunk Services will not run.
Repair by Installation gets error:
Splunkd.log:
08-31-2017 18:36:09.265 +0200 INFO loader - win-service: Starting as a Windows service: will run various system checks first...
08-31-2017 18:36:09.265 +0200 INFO loader - win-service: Splunk starting as a local administrator
08-31-2017 18:36:09.265 +0200 INFO loader - Automatic migration of modular inputs
08-31-2017 18:36:10.275 +0200 ERROR loader - win-service: Error running pre-flight-checks (_pclose returned 1).
08-31-2017 18:36:10.275 +0200 ERROR loader - win-service: Here is the output from running pre-flight-checks:
08-31-2017 18:36:10.275 +0200 ERROR loader - Checking critical directories... Done
08-31-2017 18:36:10.275 +0200 ERROR loader - Checking indexes...
08-31-2017 18:36:10.275 +0200 ERROR loader - Validated: _audit _blocksignature _internal _introspection _thefishbucket alerts filewatcher filialverwaltung hhc history main nagios perfmon ping_test summary transactional_data wineventlog
08-31-2017 18:36:10.275 +0200 ERROR loader - Done
08-31-2017 18:36:10.275 +0200 ERROR loader - Traceback (most recent call last):
08-31-2017 18:36:10.275 +0200 ERROR loader - File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 17, in
08-31-2017 18:36:10.275 +0200 ERROR loader - import splunk.clilib.cli_common as comm
08-31-2017 18:36:10.275 +0200 ERROR loader - File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli_common.py", line 8, in
08-31-2017 18:36:10.275 +0200 ERROR loader - import httplib, shutil
08-31-2017 18:36:10.275 +0200 ERROR loader - File "C:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 73, in
08-31-2017 18:36:10.275 +0200 ERROR loader - from urlparse import urlsplit
08-31-2017 18:36:10.275 +0200 ERROR loader - ImportError: cannot import name urlsplit
08-31-2017 18:36:10.275 +0200 ERROR loader - <<<<< EOF (pre-flight-checks)
08-31-2017 18:41:07.641 +0200 INFO loader - win-service: Starting as a Windows service: will run various system checks first...
08-31-2017 18:41:07.649 +0200 INFO loader - win-service: Splunk starting as a local administrator
08-31-2017 18:41:07.649 +0200 INFO loader - Automatic migration of modular inputs
08-31-2017 18:41:08.798 +0200 ERROR loader - win-service: Error running pre-flight-checks (_pclose returned 1).
08-31-2017 18:41:08.798 +0200 ERROR loader - win-service: Here is the output from running pre-flight-checks:
08-31-2017 18:41:08.798 +0200 ERROR loader - Checking critical directories... Done
08-31-2017 18:41:08.798 +0200 ERROR loader - Checking indexes...
08-31-2017 18:41:08.798 +0200 ERROR loader - Validated: _audit _blocksignature _internal _introspection _thefishbucket alerts filewatcher filialverwaltung hhc history main nagios perfmon ping_test summary transactional_data wineventlog
08-31-2017 18:41:08.798 +0200 ERROR loader - Done
08-31-2017 18:41:08.798 +0200 ERROR loader - Traceback (most recent call last):
08-31-2017 18:41:08.798 +0200 ERROR loader - File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli.py", line 17, in
08-31-2017 18:41:08.798 +0200 ERROR loader - import splunk.clilib.cli_common as comm
08-31-2017 18:41:08.798 +0200 ERROR loader - File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\clilib\cli_common.py", line 8, in
08-31-2017 18:41:08.798 +0200 ERROR loader - import httplib, shutil
08-31-2017 18:41:08.798 +0200 ERROR loader - File "C:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 73, in
08-31-2017 18:41:08.798 +0200 ERROR loader - from urlparse import urlsplit
08-31-2017 18:41:08.798 +0200 ERROR loader - ImportError: cannot import name urlsplit
08-31-2017 18:41:08.798 +0200 ERROR loader - <<<<< EOF (pre-flight-checks)
That worked for me:
Move installation file (.msi) to a temporary folder:
c:\temp\splunk-<version>-x64-release.msi
Open a command prompt (CMD) with administrative privileges and start installation with enhanced logging:
msiexec /i c:\temp\splunk-<version>-x64-release.msi /l*vx msiexec.log
Seems like the installation with enhanced logging scared it and it worked 🙂
Thank you very much for that hint, jobe256
This is a step-by-step solution that worked for me based on previous answers (several threads):
Local installation of the 64-bit version on a Windows 10 laptop.
Move installation file (.msi) to a temporary folder:
c:\temp\splunk-7.3.1.1-7651b7244cf2-x64-release.msi
Open a command prompt (CMD) with administrative privileges and start installation with enhanced logging:
msiexec /i c:\temp\splunk-7.3.1.1-7651b7244cf2-x64-release.msi /l*vx msiexec.log
Change the default installation folder/path in setup wizard, choose a folder other than the default program folders (c:\program files, c:\program files (x86) etc.) because of possible corporate restrictions/policys (folder permissions). I created a new folder when prompted in the setup wizard: C:\Local\Program\Splunk
The setup wizard then continued and installed Splunk as expected with no errors and web GUI (localhost:8000) worked fine.
I hope some of the above steps will help with any similar installation issues.
Did you ever get this working? What was the problem and how did you get around it? Please post here and help others!
There is a default log file in AppData/Local/Temp/splunk.log
, and you can force more logging with $ msiexec /I <splunk-MSI> /l*v <log-file>
. The problem is almost always that Splunk cannot write to the disk because of a permission problem.