Error when trying to install splunk on Windows Server 2008

[bbarkinwilkins]

When we try to install splunk on a Windows Server 2008, we get this error message: "Splunk Installer was unable to create Splunk Services."

We get the same error when we try to have it run as either a local system account or as an administrator account.

Any ideas?

[Ed]

Did the error dialog have an error code? In most cases there are two reasons why Splunk would fail to create the services:

The user credentials provided do not have permission to create the service. If it's a new account, Log On As A Service might not be granted to the account. To test, try assigning an existing service to this user. Usually this shows an error code of 1.

The Splunk service may already exist on the machine. Sometimes uninstalls will mark the service for deletion, but will not actually remove it until a reboot. Usually this shows an error code of 2.

Please let me know if either of these are the case or if it's something different.

[Ed]

Interesting. Glad you were able to get it working. If it pops up again, the MSI log and more likely the Splunk-.log in the %TEMP% folder might provide more clues. The Splunk-.log gets overwritten with each run though, so no way to travel back in time to see what happened.

[bbarkinwilkins]

Thanks for the response Ed!

We received an error code of 1. But I don't think this had anything to do with the user permissions because the installation of Splunk 4.1 worked flawlessly. It was only Splunk 4.2 that did not work.

[bbarkinwilkins]

Quick update: it appears this problem only occurs with verison 4.2. I tried installing 4.1 and it worked perfectly.

[bbarkinwilkins]

Another update: once we had 4.1 installed, we were able to upgrade to 4.2 without a problem.