only 1 of my indexer having this issue during upgrade.
firstly , i use domain account to install
Then encounter this issue :
Splunk Enterprise Setup Wizard ended prematurely
Splunk Enterprise Setup Wizard ended prematurely because of an error. Your system has not been modified. To install this program at a later time, run Setup Wizard again. Click the Fiinish button to exit the Setup Wizard.
Setup cannot copy the following files:
Splknetdrv.sys
SplunkMonitorNoHandleDrv.sys
SplunkDrv.sys
after then i refer to this KB : https://community.splunk.com/t5/Installation/Why-does-Splunk-upgrade-to-version-9-1-0-1-end-prematur...
follow this step :
Solution:
Install Splunk from the command line and use the LAUNCHSPLUNK=0 flag to keep Splunk Enterprise from starting after installation has completed.
For example :
PS C:\temp> msiexec.exe /i splunk-9.0.4-de405f4a7979-x64-release.msi LAUNCHSPLUNK=0
You can complete the installation, and before running SPLUNK, you need to grant the user "Full Control" permissions to the Splunk Enterprise installation directory and all of its subdirectories.
Splunk upgraded succesufully to 9.1.2 but not able to start .
i changed to local admin and try repair but yet still hit same error :
Setup cannot copy the following files:
Splknetdrv.sys
SplunkMonitorNoHandleDrv.sys
SplunkDrv.sys
my splunk services still not able to start and cant see any error in logs.
The Splunk services are still unable to start, and there are no apparent errors in the logs. Can anyone provide assistance with this issue?
