Installation

Install issue on Server 2016

dflatley
New Member

 Had Splunk Enterprise 7 running and recently updated to 8.1.2. After going over the fundamentals video I wanted to install using customize and Active directory on my Server 2016 Active Directory server. So I removed Splunk and tried to reinstall using the customize. It get most of the way done and then it does a rollback.  Looked in C:\Program files\Splunk for logs and found Splunkd-utility

02-16-2021 14:49:56.946 -0500 INFO loader - Getting configuration data from: C:\Program Files\Splunk\etc\myinstall\splunkd.xml
02-16-2021 14:49:56.947 -0500 INFO loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to C:\Program Files\Splunk\etc\modules
02-16-2021 14:49:56.947 -0500 INFO loader - loading modules from C:\Program Files\Splunk\etc\modules
02-16-2021 14:49:56.951 -0500 INFO loader - Writing out composite configuration file: C:\Program Files\Splunk\var\run\splunk\composite.xml
02-16-2021 14:49:56.972 -0500 WARN Pstacks - Backtracing is not initialized - GeneratePstacksAction cannot be used..
02-16-2021 14:49:56.972 -0500 WARN WatchdogActions - Initialization failed for action=pstacks. Deleting.
02-16-2021 14:49:56.972 -0500 INFO loader - Service "Splunkd" does not exist
02-16-2021 14:49:56.972 -0500 INFO loader - Skipping validation of index paths because may not be running as the correct user
02-16-2021 14:49:56.972 -0500 INFO loader - Validated 10 indexes in 0 microseconds
02-16-2021 14:49:57.235 -0500 INFO ServerConfig - Found no hostname options in server.conf. Will attempt to use default for now.
02-16-2021 14:49:57.235 -0500 INFO ServerConfig - Host name option is "".
02-16-2021 14:49:58.337 -0500 INFO loader - Getting configuration data from: C:\Program Files\Splunk\etc\myinstall\splunkd.xml
02-16-2021 14:49:58.337 -0500 INFO loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to C:\Program Files\Splunk\etc\modules
02-16-2021 14:49:58.337 -0500 INFO loader - loading modules from C:\Program Files\Splunk\etc\modules
02-16-2021 14:49:58.337 -0500 INFO loader - Writing out composite configuration file: C:\Program Files\Splunk\var\run\splunk\composite.xml

 

    Thanks.

    

Labels (1)
0 Karma

jho-splunk
Splunk Employee
Splunk Employee

Hi @dflatley,

To troubleshoot further we'll need logs from msiexec.exe.  You can generate them by doing something like the following from a command prompt:

msiexec /l*vx msiexec.log /i <splunk.msi>

(Where <splunk.msi> is replaced with the filename of the MSI.)

If you then search msiexec.log for the string return value 3  and paste 20 or so lines immediately preceding it, hopefully that will tell us what has gone wrong.

There may also be a file in %TEMP% called splunk.log.  That may also help shed some light.

Cheers,

 

 - Jo.

 

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...