Installation

Why is there Windows Installation Rollback error?

Stevelim
Communicator

I am performing a migration of an 8.2.2 Splunk instance into a new VM. I have copied the entire $SPLUNK_HOME (D:\Splunk) folder into the new VM machine and ran the installer. The installer fails with rollback. I have the logs with me and here is an excerpt of the failure:

MSI (s) (DC:AC) [14:20:49:588]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3EE8.tmp, Entrypoint: FirstTimeRunCA
FirstTimeRun: Warning: Invalid property ignored: FailCA=.
FirstTimeRun: Info: Properties: splunkHome: D:\Splunk.
FirstTimeRun: Info: Execute first time run.
FirstTimeRun: Info: Enter. Args: "D:\Splunk\bin\splunk.exe", _internal first-time-run --answer-yes --no-prompt
FirstTimeRun: Info: SystemPath is: C:\Windows\system32\
FirstTimeRun: Info: Execute string: C:\Windows\system32\cmd.exe /c ""D:\Splunk\bin\splunk.exe" _internal first-time-run --answer-yes --no-prompt >> "C:\Users\********\AppData\Local\Temp\splunk.log" 2>&1"
FirstTimeRun: Info: WaitForSingleObject returned : 0x0
FirstTimeRun: Info: Exit code for process : 0x2
FirstTimeRun: Info: Leave.
FirstTimeRun: Error: ExecCmd failed: 0x2.
FirstTimeRun: Error 0x80004005: Cannot execute first time run.
CustomAction FirstTimeRun returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 14:20:57: InstallFinalize. Return value 3.

Anyone has any insights?

Labels (1)
Tags (2)
0 Karma
1 Solution

Stevelim
Communicator

If anyone is stuck like me, the solution I had was to re-run with the same version of Splunk before running the latest installer.

View solution in original post

0 Karma

Stevelim
Communicator

If anyone is stuck like me, the solution I had was to re-run with the same version of Splunk before running the latest installer.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...