When I run the MSI installer for the universal forwarder on a clean install of windows server 2012 R2, I'm getting the following error from the GUI:
UniversalForwarder setup wizard ended prematurely because of an error. Your system has not been modified.
In the splunk.log file in the temp directory, there is only one line:
This appears to be your first time running this version of Splunk.
And in the /var/log/splunk/first_install.log file, again, there is no useful information:
I've enabled MSI logging and I've put the results in the gist below:
However I really have no idea what I'm looking for in this file. The user I'm trying to install this with is an administrator.
... View more