SPLUNK install stuck on Please wait while the Setup Wizard installs Splunk Enterprise

[gavinmckay]

Hi folks,

Splunk Enterprise 6.5.3 installer on Windows Server 2012 R2, fully patched OS as of 16-4-2017.

Trying to install Splunk Enterprise on a sandbox environment with no Internet access. Install screen loads, starts to install, but is stuck on "Please wait while the Setup Wizard installs Splunk Enterprise". I can't see any errors in the event log related to Splunk installation, I checked the splunk.txt file in %TEMP% and there are no errors there either. Last entry in the txt file is:

"Successfully processed 64 files; Failed processing 0 files"

I've left it for hours, no further progress at all. Have tried logging off and back on again (same), and restarting the server (same).

Anyone seen this before?

Gavin.

[chimajdev]

I had to delete the SPlunk folder in Program Files, stopped splunkd that was running and then reinstalled again and it worked. once it is done installing, the program window may be hard to see, just hit enter and it will bring you to the UI localhost:8000 where you login. lol,I had to delete the directory where Splunk was installed in (Program Files) and then stopped splunkd processor, once i did that, the installation rolled back. Then I closed and reinstalled it again. it worked!

[gavinmckay]

...of course, Splunk has a docker image too...

https://hub.docker.com/r/splunk/splunk/

[gavinmckay]

Hi there,

No, I never did get it resolved 😞 I raised a support ticket for it (a long time ago now!) but ran out of time to troubleshoot.

I just recently turned to Prometheus instead, mainly because it had a Docker image that I could deploy in about 30 seconds. Open source + free was also a good extra benefit... I am just using it within a Docker environment though, not for enterprise monitoring so I can't really compare vs Splunk in that respect.

Hope you get yours working!

Regards,

Gavin.

[kangje168]

Hey there,
Did you eventually solve this problem? I have the same problem now. How can we tell this to splunk. It seems to be a problem universal.
Thanks

[jkat54]

Check you windows application security and system event logs after the install fails to see if there are any additional details there.

[adonio]

worth to check the logs splunk generates when not able to install
check undeR $SPLUNK_HOME

[gavinmckay]

OK I enabled full logging on the installer using /lv log.txt and the last entry before it pauses is:

Execute string: cmd.exe /c "D:\Program Files\Splunk\splunk.exe" enable boot-start-loop --answer-yes --no-prompt --accept-license

And that's as far as it is getting at the moment. I tried running the command, and it starts but then nothing ever completes.

[gavinmckay]

Hi again,

Thanks for your responses, they helped me to progress a bit further.

(@jkat54) I was logged in as Administrator, but starting the installer from an Admin command prompt got me to this stage (I couldn't see the Windows Installer UI window before):

The Windows Installer Coordinator issue is a known problem when Remote Desktop Services is installed:
https://support.microsoft.com/en-au/help/2655192/installation-can-fail-with-window-installer-coordin...

I uninstalled Remote Desktop Services (I wasn't using it, and didn't know it was baked in to the image I was given) via PowerShell using:

Uninstall-WindowsFeature -ComputerName xxxx-Name RDS-Connection-Broker, RDS-Licensing, RDS-RD-Server, RDS-Web-Access, RDS-Licensing-UI

When I rebooted and tried the install again, it seemed to get further but I'm still getting hung up and when I try and cancel the process or log off I get:

@skoelpin I will try and monitor the system and see if anything flags in ProcessMonitor.

G.

[jkat54]

Did you run the install as an administrator? It could be hung on a permissions error.

[jkat54]

I've seen this before when group policy prevented local admins from creating services. It was a default at rackspace at that time. You'll need to check group policy.

https://serverfault.com/questions/55961/is-it-possible-to-use-group-policy-to-grant-the-permission-t...

[skoelpin]

Try downloading Procmon and see what it's being caught up on.

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

You should open a support ticket, it could be a bug with v6.5.3