Installation

Why does Windows Splunk upgrade to from version 9.0.6 to version 9.1.2 end prematurely?

Polarbear
Observer

only 1 of my indexer having this issue  during upgrade.

firstly , i use domain account to install 

Then encounter this issue :

Splunk Enterprise Setup Wizard ended prematurely

Splunk Enterprise Setup Wizard ended prematurely because of an error.  Your system has not been modified.  To install this program at a later time, run Setup Wizard again.  Click the Fiinish button to exit the Setup Wizard.

 

Setup cannot copy the following files: 

Splknetdrv.sys
SplunkMonitorNoHandleDrv.sys
SplunkDrv.sys

after then i refer to this KB : https://community.splunk.com/t5/Installation/Why-does-Splunk-upgrade-to-version-9-1-0-1-end-prematur...

follow this step :

Solution:

Install Splunk from the command line and use the LAUNCHSPLUNK=0 flag to keep Splunk Enterprise from starting after installation has completed.

For example :

PS C:\temp> msiexec.exe /i splunk-9.0.4-de405f4a7979-x64-release.msi LAUNCHSPLUNK=0

You can complete the installation, and before running SPLUNK, you need to grant the user "Full Control" permissions to the Splunk Enterprise installation directory and all of its subdirectories.

Splunk upgraded succesufully to 9.1.2 but not able to start .

i changed to local admin and try repair but yet still hit  same error :

Setup cannot copy the following files: 

Splknetdrv.sys
SplunkMonitorNoHandleDrv.sys
SplunkDrv.sys

my splunk services still not able to start and cant see any error in logs.

The Splunk services are still unable to start, and there are no apparent errors in the logs. Can anyone provide assistance with this issue?

 

Labels (1)
0 Karma

jho-splunk
Splunk Employee
Splunk Employee

Hi @Polarbear,

Please see here on how to troubleshoot further: Re: Install issue on Server 2016 - Splunk Community.

Cheers,

 

 - Jo.

 

0 Karma

Polarbear
Observer

Windows hardening which cause the issue . Solved after adjust the permissions. 

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...