Installation

SPLUNK install stuck on Please wait while the Setup Wizard installs Splunk Enterprise

gavinmckay
New Member

Hi folks,

Splunk Enterprise 6.5.3 installer on Windows Server 2012 R2, fully patched OS as of 16-4-2017.

Trying to install Splunk Enterprise on a sandbox environment with no Internet access. Install screen loads, starts to install, but is stuck on "Please wait while the Setup Wizard installs Splunk Enterprise". I can't see any errors in the event log related to Splunk installation, I checked the splunk.txt file in %TEMP% and there are no errors there either. Last entry in the txt file is:

"Successfully processed 64 files; Failed processing 0 files"

I've left it for hours, no further progress at all. Have tried logging off and back on again (same), and restarting the server (same).

Anyone seen this before?

Gavin.

Tags (1)
0 Karma

chimajdev
New Member

I had to delete the SPlunk folder in Program Files, stopped splunkd that was running and then reinstalled again and it worked. once it is done installing, the program window may be hard to see, just hit enter and it will bring you to the UI localhost:8000 where you login. lol,I had to delete the directory where Splunk was installed in (Program Files) and then stopped splunkd processor, once i did that, the installation rolled back. Then I closed and reinstalled it again. it worked!

0 Karma

gavinmckay
New Member

...of course, Splunk has a docker image too...

https://hub.docker.com/r/splunk/splunk/

0 Karma

gavinmckay
New Member

Hi there,

No, I never did get it resolved 😞 I raised a support ticket for it (a long time ago now!) but ran out of time to troubleshoot.

I just recently turned to Prometheus instead, mainly because it had a Docker image that I could deploy in about 30 seconds. Open source + free was also a good extra benefit... I am just using it within a Docker environment though, not for enterprise monitoring so I can't really compare vs Splunk in that respect.

Hope you get yours working!

Regards,

Gavin.

0 Karma

kangje168
Explorer

Hey there,
Did you eventually solve this problem? I have the same problem now. How can we tell this to splunk. It seems to be a problem universal.
Thanks

0 Karma

jkat54
SplunkTrust
SplunkTrust

Check you windows application security and system event logs after the install fails to see if there are any additional details there.

0 Karma

adonio
Ultra Champion

worth to check the logs splunk generates when not able to install
check undeR $SPLUNK_HOME

0 Karma

gavinmckay
New Member

OK I enabled full logging on the installer using /lv log.txt and the last entry before it pauses is:

Execute string: cmd.exe /c "D:\Program Files\Splunk\splunk.exe" enable boot-start-loop --answer-yes --no-prompt --accept-license

And that's as far as it is getting at the moment. I tried running the command, and it starts but then nothing ever completes.

0 Karma

gavinmckay
New Member

Hi again,

Thanks for your responses, they helped me to progress a bit further.

(@jkat54) I was logged in as Administrator, but starting the installer from an Admin command prompt got me to this stage (I couldn't see the Windows Installer UI window before):

alt text

The Windows Installer Coordinator issue is a known problem when Remote Desktop Services is installed:
https://support.microsoft.com/en-au/help/2655192/installation-can-fail-with-window-installer-coordin...

I uninstalled Remote Desktop Services (I wasn't using it, and didn't know it was baked in to the image I was given) via PowerShell using:

Uninstall-WindowsFeature -ComputerName xxxx-Name RDS-Connection-Broker, RDS-Licensing, RDS-RD-Server, RDS-Web-Access, RDS-Licensing-UI

When I rebooted and tried the install again, it seemed to get further but I'm still getting hung up and when I try and cancel the process or log off I get:

alt text

@skoelpin I will try and monitor the system and see if anything flags in ProcessMonitor.

G.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Did you run the install as an administrator? It could be hung on a permissions error.

0 Karma

jkat54
SplunkTrust
SplunkTrust

I've seen this before when group policy prevented local admins from creating services. It was a default at rackspace at that time. You'll need to check group policy.

https://serverfault.com/questions/55961/is-it-possible-to-use-group-policy-to-grant-the-permission-t...

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try downloading Procmon and see what it's being caught up on.

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

You should open a support ticket, it could be a bug with v6.5.3

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...