Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Installation
- :
- Unsuccessful in installing Splunk on Windows 2003 ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, The first installation of Splunk on Windows 2003 server was successful with no errors.
However, we were unable to access SplunkWeb via http://localhost:8000.
Have checked the services for Splunkd and SplunkWeb and both are running.
We tried to uninstall and reinstall Splunk but the second time when installation near completion, there is an error pop up saying:
"Splunk install error The specified service has been marked for deletion. Splunk will not start when you complete this installation. Use the Windows Service Control Manager to specify the correct user for the Splunkd service before starting Splunk"
Does restarting the system able to resolve the error? OR is there alternatives to resolve it without restarting the server which we would prefer not to..
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried using the IP address of the host system in the Splunk URL? *"http://IP.address.here:8000" I have seen a similar error with user credentials in the install too. Go to Services and verify that the user account your using to start splunkd and splunkweb can authenticate and the service starts properly, and the account has admin rights. You can use the "wbemtest" in the admin manual (page 62) to verify the accounts functionality. You can also try changning the default port that splunk uses in the Web.conf file. Probably requires a splunk restart not system restart.
Good Luck V
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No idea how to solve it..not able to restart production server now probably has to schedule it.
Anyway, the suggestions are useful in troubleshooting installation issues as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried using the IP address of the host system in the Splunk URL? *"http://IP.address.here:8000" I have seen a similar error with user credentials in the install too. Go to Services and verify that the user account your using to start splunkd and splunkweb can authenticate and the service starts properly, and the account has admin rights. You can use the "wbemtest" in the admin manual (page 62) to verify the accounts functionality. You can also try changning the default port that splunk uses in the Web.conf file. Probably requires a splunk restart not system restart.
Good Luck V
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is the service still listed in services.msc? If it is not and you have closed services.msc but the install error persists you will need to re-start Windows before the re-install.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The one thing you may want to consider is conflict on port usage. Is the server you're running splunk in uses the port 8000 already? I would look into the splunkd.log file to see if there's any error.
A restart might be necessary to do a clean re-install.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
