Installation

Splunk Enterprise Installation Issue – Inaccessible D Drive

anasb4u
New Member

Hi Splunk Community,

I recently attempted to install Splunk Enterprise on my Windows 11 local machine using the .msi installer. During the installation:

  • I checked the box to create a desktop shortcut, but after the installation completed, the shortcut did not appear.

  • I also changed the default installation directory from C:\ to my D:\ drive.

  • After the installation, I noticed that my entire D drive became inaccessible, and I’m now getting the following error:

            Location is not available
            D:\ is not accessible.

I'm unsure what went wrong during the installation. Not only did the shortcut not appear, but now I can't even access my D drive.

Has anyone else experienced this issue? Could this be due to a permission error, drive formatting, or something caused by the installer? Any guidance on how I can fix or recover my D drive and properly install Splunk would be greatly appreciated.

Thanks in advance!

Labels (1)
0 Karma

anasb4u
New Member

 

Thanks for the earlier support. Just wanted to post a quick update in case anyone else runs into a similar situation.

Issue:
I was unable to access my D:\ drive via File Explorer due to what seemed like permission issues, but I was able to access the drive through CLI (PowerShell). Running Get-Acl on the drive showed that the owner and permissions seemed okay, but Explorer still denied access.

Solution:
Turns out, the permissions were either incomplete or not properly recognized by File Explorer. I resolved the issue using the following PowerShell command:

 

powershell
 
icacls D:\ /grant "*YourUsernameHere*:(OI)(CI)F" /T

📌 Replace *YourUsernameHere* with your actual Windows username.

This command grants Full Control recursively (/T) for all files and folders inside D:\, ensuring proper access.

After running this, I was able to access the drive in File Explorer without any problems.

🔍 Note:
To audit how the permissions may have changed, you can enable Object Access Auditing using auditpol and review Event ID 4670 in Event Viewer > Windows Logs > Security.

Possible Correlation with Splunk Enterprise Installation

After reflecting on the issue, I suspect that this might have occurred right after installing Splunk Enterprise. While I could be mistaken, it would be great if the Splunk team could check on this to ensure it doesn’t affect others in the future.

I hope this helps anyone facing a similar issue, and I look forward to any additional insights or suggestions from the community.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just for clarification - this is a community-driven forum and while there are some Splunk Employees lurking here it's highly unlikely (unless maybe there is a grave error destroying your indexes or such) that someone will invest company time on this without a support ticket. And of course support portal where you can raise rickets is three blocks south from here 😉

0 Karma

livehybrid
Champion

Hi

This is likely a Windows OS or disk issue unrelated to the Splunk installer itself. Installing Splunk should not cause your entire D:\ drive to become inaccessible.

To recover access to your D:\ drive:

  1. Open Disk Management (diskmgmt.msc) and check if the drive is visible, healthy, and has a drive letter assigned.
  2. If the drive appears offline or unallocated, investigate hardware or file system corruption.
  3. Use chkdsk to scan and repair:

Regarding the missing desktop shortcut, this sounds like it’s a minor issue likely due to permission or installer hiccup. You can manually create a shortcut from D:\Program Files\Splunk\bin\splunk.exe (or wherever you installed). Although there is a chance the installation did not actually succeed? Verify this once you have resolved your access to the 😧 drive.

 

🌟 Did this answer help you? If so, please consider:

  • Adding kudos to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

anasb4u
New Member

Hi,

In Disk Management, the drive is showing as Healthy and the drive letter is assigned correctly. However, I'm still unable to access the drive — it continues to show the same error when I try to open it.

I'm attaching the exact error message that appears when attempting to open the D:\ drive for your reference.

I have also tried running the chkdsk 😧 /f /r command. It completed successfully, but unfortunately, the issue still persists.

Would appreciate any further suggestions. Thanks!

anasb4u_0-1744286603363.png

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not very familiar with windows Splunk setup but it is highly unlikely that it's related to the Splunk installer. I'd hazard a guess that it's either a coincidence and at the same time - for example - there was an update of GPO or you have some third-party solution (EDR of some sort?) which was triggered by the installation.

0 Karma

anasb4u
New Member

Hi,

I understand your point, but I’d like to clarify a few things from my side. The issue with my D:\ drive started immediately after installing Splunk Enterprise — just before the installation, I had accessed the drive without any problems.

There are no EDR or third-party security solutions installed on my system, so that can be ruled out.

Although the Splunk installation process appeared to complete, I can’t find it anywhere on the system — not in the Control Panel, not in the installation directory, and there’s no desktop shortcut either. It seems like something went wrong during the install, and I strongly suspect that’s what caused the issue with my drive.

Appreciate your input, and I’m open to any suggestions that could help further.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

As I said - that sounds improbably but of course not impossible. Especially since it's windows 😉

I'd go for support case at this point (or just do a quick windows reinstall if you can afford it - might be faster).

BTW, did you verify the installer checksum before running it?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

It’s go time — Boston, here we come!

Are you ready to take your Splunk skills to the next level? Get set, because Splunk University is back, and ...

Performance Tuning the Platform, SPL2 Templates, and More New Articles on Splunk ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...