Splunk Enterprise Installation Issue – Inaccessible D Drive

[anasb4u]

Hi Splunk Community,

I recently attempted to install Splunk Enterprise on my Windows 11 local machine using the .msi installer. During the installation:

• I checked the box to create a desktop shortcut, but after the installation completed, the shortcut did not appear.

• I also changed the default installation directory from C:\ to my D:\ drive.

• After the installation, I noticed that my entire D drive became inaccessible, and I’m now getting the following error:

            Location is not available
            D:\ is not accessible.

I'm unsure what went wrong during the installation. Not only did the shortcut not appear, but now I can't even access my D drive.

Has anyone else experienced this issue? Could this be due to a permission error, drive formatting, or something caused by the installer? Any guidance on how I can fix or recover my D drive and properly install Splunk would be greatly appreciated.

Thanks in advance!

[anasb4u]

Thanks for the earlier support. Just wanted to post a quick update in case anyone else runs into a similar situation.

✅ Issue:
I was unable to access my D:\ drive via File Explorer due to what seemed like permission issues, but I was able to access the drive through CLI (PowerShell). Running Get-Acl on the drive showed that the owner and permissions seemed okay, but Explorer still denied access.

✅ Solution:
Turns out, the permissions were either incomplete or not properly recognized by File Explorer. I resolved the issue using the following PowerShell command:

powershell

 

icacls D:\ /grant "*YourUsernameHere*:(OI)(CI)F" /T

📌 Replace *YourUsernameHere* with your actual Windows username.

This command grants Full Control recursively (/T) for all files and folders inside D:\, ensuring proper access.

After running this, I was able to access the drive in File Explorer without any problems.

🔍 Note:
To audit how the permissions may have changed, you can enable Object Access Auditing using auditpol and review Event ID 4670 in Event Viewer > Windows Logs > Security.

Possible Correlation with Splunk Enterprise Installation

After reflecting on the issue, I suspect that this might have occurred right after installing Splunk Enterprise. While I could be mistaken, it would be great if the Splunk team could check on this to ensure it doesn’t affect others in the future.

I hope this helps anyone facing a similar issue, and I look forward to any additional insights or suggestions from the community.

[PickleRick]

Just for clarification - this is a community-driven forum and while there are some Splunk Employees lurking here it's highly unlikely (unless maybe there is a grave error destroying your indexes or such) that someone will invest company time on this without a support ticket. And of course support portal where you can raise rickets is three blocks south from here 😉

[livehybrid]

Hi

This is likely a Windows OS or disk issue unrelated to the Splunk installer itself. Installing Splunk should not cause your entire D:\ drive to become inaccessible.

To recover access to your D:\ drive:

1. Open Disk Management (diskmgmt.msc) and check if the drive is visible, healthy, and has a drive letter assigned.
2. If the drive appears offline or unallocated, investigate hardware or file system corruption.
3. Use chkdsk to scan and repair:

Regarding the missing desktop shortcut, this sounds like it’s a minor issue likely due to permission or installer hiccup. You can manually create a shortcut from D:\Program Files\Splunk\bin\splunk.exe (or wherever you installed). Although there is a chance the installation did not actually succeed? Verify this once you have resolved your access to the 😧 drive.

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[anasb4u]

Hi,

In Disk Management, the drive is showing as Healthy and the drive letter is assigned correctly. However, I'm still unable to access the drive — it continues to show the same error when I try to open it.

I'm attaching the exact error message that appears when attempting to open the D:\ drive for your reference.

I have also tried running the chkdsk 😧 /f /r command. It completed successfully, but unfortunately, the issue still persists.

Would appreciate any further suggestions. Thanks!

[PickleRick]

I'm not very familiar with windows Splunk setup but it is highly unlikely that it's related to the Splunk installer. I'd hazard a guess that it's either a coincidence and at the same time - for example - there was an update of GPO or you have some third-party solution (EDR of some sort?) which was triggered by the installation.

[anasb4u]

Hi,

I understand your point, but I’d like to clarify a few things from my side. The issue with my D:\ drive started immediately after installing Splunk Enterprise — just before the installation, I had accessed the drive without any problems.

There are no EDR or third-party security solutions installed on my system, so that can be ruled out.

Although the Splunk installation process appeared to complete, I can’t find it anywhere on the system — not in the Control Panel, not in the installation directory, and there’s no desktop shortcut either. It seems like something went wrong during the install, and I strongly suspect that’s what caused the issue with my drive.

Appreciate your input, and I’m open to any suggestions that could help further.

[PickleRick]

As I said - that sounds improbably but of course not impossible. Especially since it's windows 😉

I'd go for support case at this point (or just do a quick windows reinstall if you can afford it - might be faster).

BTW, did you verify the installer checksum before running it?