Installation

splunk enterprise

saddam979
Explorer

Hi Team,

I am trying to install Splunk enterprise in my windows 10.

But i  am getting this error as splunk enterprise setup wizard ended prematurely.

I have tried multiple time still get the same error .

Please any once can help me in this .

Thank you. 

 

 

splunk  error.PNG

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @saddam979,

as @SanjayReddy said, probably the problem is that yopu didn't run the setup as an administrator.

Anyway, in $SPLUNK_HOME\var\log\splunk you should find the "first_install.log" file containing all the logs of your failed installation and the other Splunk logs to understand what happened.

Ciao.

Giuseppe

isoutamo
SplunkTrust
SplunkTrust

Hi

as it already said you must add full path for psi package on cmd line. I'm using this when installing e.g. UF on windows.

msiexec.exe /i <path to temp>/splunkforwarder-<XXXXX>-x64-release.msi AGREETOLICENSE=yes LAUNCHSPLUNK=no SERVICESTARTTYPE=auto /quiet /l*v install-log.txt

After that and before first start I will add TA for connecting DS and information about splunk indexers or next hops if those are e.g. IHF. All those steps must do on user which have Admin role/rights. And As @gcusello said you could find splunk logs under %SPLUNK_HOME% and installation logs is in this install-log.txt file.

r. Ismo 

SanjayReddy
SplunkTrust
SplunkTrust

Hi @saddam979 

Have you tried running setup file with run as administartaor 

 try from CMD as administrator

msiexec.exe /i splunk-<...>-x64-release.msi


https://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonWindowsviathecommandline#I... 

saddam979
Explorer

Hi @SanjayReddy ,

Thank you for the suggestion.

As per your request i have run the CMD as an administrator.

File is located on my desktop.

when I run the command as : msiexec.exe /i C:\Users\Desktop\splunk-8.2.2-87344edfcdb4-x64-release.msi 

It gives the error as installation_pack error.PNG

I get this error.

Then i checked the services for the windows installer  i have started that and then used this cmd command it get this.

when run the command.PNG

After pressing Okay nothing happen.

Not sure what is wrong.

Please help me in this .

Thank you.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

As it was said, you must use the full path here. You are probably missing user id on previous path? And if you look my previous post and add that debugging part to the end of command you will get more information what went wrong or what it has done.

/l*v install-log.txt

r. Ismo

saddam979
Explorer

 Hi @SanjayReddy 

Thank you for the reply.

As per your   and @gcusello  suggestion.

I have tried to run the setup n CMD as admin with this command .

msiexec.exe /i splunk-<splunk-8.2.2-87344edfcdb4>-x64-release.msi

But i get the error message as "The system cannot find the file specified."

Even i have tried msiexec/i splunkfilename.msi 

I get the error as " This installation  could not be opened.

I have attached the pic for the reference.

@gcusello The path which you have mentioned to collect the log and investigate is not available in my system. May be because it is not getting installed in the system.

Please help with your suggestion.msiexec/i splunkfilename.msimsiexec/i splunkfilename.msimsiexec.exe /i splunk-<splunk-8.2.2-87344edfcdb4>-x64-release.msimsiexec.exe /i splunk-<splunk-8.2.2-87344edfcdb4>-x64-release.msi

 

 

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

@saddam979 

Thank you for your reply.

you need to mention location of the splunk msi file while running the command 

exmaple 
msiexec.exe /i C:\Users\Desktop\splunk-8.2.2-87344edfcdb4-x64-release.msi

 

 

Hope this helps to install the splunk on systme 

shivanshu1593
Builder

In event viewer, under applications, please check for event ids 1001 to 1017. It should give you an idea as to why the installation failed.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###

saddam979
Explorer

Hi @shivanshu1593 ,

Thank you for the suggestion i have checked the logs.

But not able to get the exact event ID..

I installed the Software today and checked for the failed event.

I got this :-Event ID 1552.
User Profile Service

With the description as :- User hive is loaded by another process (Registry Lock) Process name: C:\Windows\System32\SecurityHealthService.exe, PID: 13308, ProfSvc PID: 2024

Can you help me with this further in this case.

Thank you

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...