When I run the MSI installer for the universal forwarder on a clean install of windows server 2012 R2, I'm getting the following error from the GUI: UniversalForwarder setup wizard ended prematurely because of an error. Your system has not been modified. In the splunk.log file in the temp directory, there is only one line: This appears to be your first time running this version of Splunk. And in the /var/log/splunk/first_install.log file, again, there is no useful information: VERSION=6.2.2 BUILD=255606 PRODUCT=splunk PLATFORM=Windows-AMD64 I've enabled MSI logging and I've put the results in the gist below: https://gist.github.com/anonymous/8b692986e99f8945a836 However I really have no idea what I'm looking for in this file. The user I'm trying to install this with is an administrator. ... View more