splunk enterprise

[saddam979]

Hi Team,

I am trying to install Splunk enterprise in my windows 10.

But i  am getting this error as splunk enterprise setup wizard ended prematurely.

I have tried multiple time still get the same error .

Please any once can help me in this .

Thank you. 

[gcusello]

Hi @saddam979,

as @SanjayReddy said, probably the problem is that yopu didn't run the setup as an administrator.

Anyway, in $SPLUNK_HOME\var\log\splunk you should find the "first_install.log" file containing all the logs of your failed installation and the other Splunk logs to understand what happened.

Ciao.

Giuseppe

[isoutamo]

Hi

as it already said you must add full path for psi package on cmd line. I'm using this when installing e.g. UF on windows.

msiexec.exe /i <path to temp>/splunkforwarder-<XXXXX>-x64-release.msi AGREETOLICENSE=yes LAUNCHSPLUNK=no SERVICESTARTTYPE=auto /quiet /l*v install-log.txt

After that and before first start I will add TA for connecting DS and information about splunk indexers or next hops if those are e.g. IHF. All those steps must do on user which have Admin role/rights. And As @gcusello said you could find splunk logs under %SPLUNK_HOME% and installation logs is in this install-log.txt file.

r. Ismo 

[SanjayReddy]

Hi @saddam979 

Have you tried running setup file with run as administartaor 

 try from CMD as administrator

msiexec.exe /i splunk-<...>-x64-release.msi


https://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonWindowsviathecommandline#I... 

[saddam979]

Hi @SanjayReddy ,

Thank you for the suggestion.

As per your request i have run the CMD as an administrator.

File is located on my desktop.

when I run the command as : msiexec.exe /i C:\Users\Desktop\splunk-8.2.2-87344edfcdb4-x64-release.msi 

It gives the error as 

I get this error.

Then i checked the services for the windows installer  i have started that and then used this cmd command it get this.

After pressing Okay nothing happen.

Not sure what is wrong.

Please help me in this .

Thank you.

[isoutamo]

Hi

As it was said, you must use the full path here. You are probably missing user id on previous path? And if you look my previous post and add that debugging part to the end of command you will get more information what went wrong or what it has done.

/l*v install-log.txt

r. Ismo

[saddam979]

 Hi @SanjayReddy 

Thank you for the reply.

As per your   and @gcusello  suggestion.

I have tried to run the setup n CMD as admin with this command .

msiexec.exe /i splunk-<splunk-8.2.2-87344edfcdb4>-x64-release.msi

But i get the error message as "The system cannot find the file specified."

Even i have tried msiexec/i splunkfilename.msi 

I get the error as " This installation  could not be opened.

I have attached the pic for the reference.

@gcusello The path which you have mentioned to collect the log and investigate is not available in my system. May be because it is not getting installed in the system.

Please help with your suggestion.msiexec/i splunkfilename.msimsiexec.exe /i splunk-<splunk-8.2.2-87344edfcdb4>-x64-release.msi

[SanjayReddy]

@saddam979 

Thank you for your reply.

you need to mention location of the splunk msi file while running the command 

exmaple 
msiexec.exe /i C:\Users\Desktop\splunk-8.2.2-87344edfcdb4-x64-release.msi

Hope this helps to install the splunk on systme 

[shivanshu1593]

In event viewer, under applications, please check for event ids 1001 to 1017. It should give you an idea as to why the installation failed.

[saddam979]

Hi @shivanshu1593 ,

Thank you for the suggestion i have checked the logs.

But not able to get the exact event ID..

I installed the Software today and checked for the failed event.

I got this :-Event ID 1552.
User Profile Service

With the description as :- User hive is loaded by another process (Registry Lock) Process name: C:\Windows\System32\SecurityHealthService.exe, PID: 13308, ProfSvc PID: 2024

Can you help me with this further in this case.

Thank you