Installation

UniversalForwarder installation fails with no errors when trying to upgrade silently from 6.5.1 to 7.1.1

jajohn2016s
New Member

Installation via GUI is like 2 clicks after accepting license agreement. Works splendidly.

Dug through the manual, adjusted my silent install commands, etc. Nada.

msiexec.exe /i splunkforwarder-7.1.1-8f0ead9ec3db-x64-release AGREETOLICENSE=Yes /quiet /L*v logfile.txt

The upgrade from 6.5.1 to 7.1.1 doesn't ask again for the deployment server, I've tried literally all the options I can.

However, I have many systems I need to install the UF on, like a few hundred. I even turned on the verbosity of the install, and this is all I get:

=== Verbose logging started: 6/14/2018  12:11:21  Build type: SHIP UNICODE 5.00.7601.00  Calling process: C:\Windows\system32\msiexec.exe ===
MSI (c) (B4:68) [12:11:21:286]: Resetting cached policy values
MSI (c) (B4:68) [12:11:21:286]: Machine policy value 'Debug' is 0
MSI (c) (B4:68) [12:11:21:286]: ******* RunEngine:
           ******* Product: splunkforwarder-7.1.1-8f0ead9ec3db-x64-release
           ******* Action: 
           ******* CommandLine: **********
MSI (c) (B4:68) [12:11:21:286]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (B4:68) [12:11:21:286]: Grabbed execution mutex.
MSI (c) (B4:68) [12:11:21:411]: Cloaking enabled.
MSI (c) (B4:68) [12:11:21:411]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (B4:68) [12:11:21:411]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (50:54) [12:11:21:426]: Running installation inside multi-package transaction D:\temp\splunkforwarder-7.1.1-8f0ead9ec3db-x64-release
MSI (s) (50:54) [12:11:21:426]: Grabbed execution mutex.
MSI (s) (50:F4) [12:11:21:426]: Resetting cached policy values
MSI (s) (50:F4) [12:11:21:426]: Machine policy value 'Debug' is 0
MSI (s) (50:F4) [12:11:21:426]: ******* RunEngine:
           ******* Product: D:\temp\splunkforwarder-7.1.1-8f0ead9ec3db-x64-release
           ******* Action: 
           ******* CommandLine: **********
MSI (s) (50:F4) [12:11:21:426]: Note: 1: 2203 2: D:\temp\splunkforwarder-7.1.1-8f0ead9ec3db-x64-release 3: -2147287038 
MSI (s) (50:F4) [12:11:21:426]: MainEngineThread is returning 2
MSI (s) (50:54) [12:11:21:442]: User policy value 'DisableRollback' is 0
MSI (s) (50:54) [12:11:21:442]: Machine policy value 'DisableRollback' is 0
MSI (s) (50:54) [12:11:21:442]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (50:54) [12:11:21:442]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 
MSI (s) (50:54) [12:11:21:442]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 
MSI (s) (50:54) [12:11:21:442]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2 
MSI (s) (50:54) [12:11:21:442]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2 
MSI (s) (50:54) [12:11:21:442]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (s) (50:54) [12:11:21:442]: Restoring environment variables
MSI (c) (B4:68) [12:11:21:442]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (B4:68) [12:11:21:442]: MainEngineThread is returning 2
=== Verbose logging stopped: 6/14/2018  12:11:21 ===
Tags (1)
0 Karma

jajohn2016s
New Member

I gave up... after procmon'ing for half the day and not getting any logs I have to move on and do the 2008 installs manually. Issue didn't happen on 2012r2 or my other test boxes.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...