rpm upgrade not working...

[pil321]

I inherited a Splunk server that I'm trying to do an upgrade on, but the rpm keeps hanging.

rpm -Uvh splunk-6.1........

and when it tries to upgrade it hangs at:

This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed Splunk Server...

The server is hardened with DOD STIG, so maybe that is the issue? Which logs would I look at to get some answers?

Running RHEL 6.8

[rarsan_splunk]

This is likely related to user permissions.
Which user is Splunk running as?
Which user are you running the rpm upgrade as?
Also, check init script for Splunk be it init /etc/init.d/splunk or systemd e.g. /etc/systemd/system/splunk.service

[pil321]

Splunk is running as 'splunk'

The rpm upgrade is running as 'root'

What should I look for in /etc/init.d/splunk?

A side note on this: the server was running Splunk as 'root' when I first looked at it. I changed the permissions so that the user 'splunk' would run it instead.