About jho-splunk

jho-splunk · ‎02-08-2024

Hi @Polarbear, Please see here on how to troubleshoot further: Re: Install issue on Server 2016 - Splunk Community. Cheers, - Jo.

jho-splunk · ‎08-30-2023

Hi @pagillar, Please see here for instructions on how to troubleshoot further: https://community.splunk.com/t5/Installation/Install-issue-on-Server-2016/m-p/540173/highlight/true#.... Cheers, - Jo.

jho-splunk · ‎08-16-2023

Hi @mofonguero, Please see here for instructions on how to troubleshoot further: https://community.splunk.com/t5/Installation/Install-issue-on-Server-2016/m-p/540173/highlight/true#.... Cheers, - Jo.

jho-splunk · ‎08-12-2023

Hi @_alex, Unfortunately installation failures typically end very generically so it's impossible to know what happened without more information. Please see here for instructions on how to troubleshoot further: https://community.splunk.com/t5/Installation/Install-issue-on-Server-2016/m-p/540173/highlight/true#.... Cheers, - Jo.

jho-splunk · ‎08-02-2023

Hi @Gregski11, Hmmm...not much to go on there unfortunately. Is there a %TEMP%\splunk.log? How long does it take to fail to start? There may be salient errors and/or warnings in splunkd.log and/or web_service.log. If there's nothing there, then we'll probably need to resort to a Process Monitor trace, but unfortunately that's not typically very shareable here. Are you on the splunk-usergroups Slack, perchance? Cheers, - Jo.

jho-splunk · ‎08-01-2023

HI @Gregski11 , Everything appears be fine in the snippet you posted. Please see here for instructions on how to troubleshoot further: https://community.splunk.com/t5/Installation/Install-issue-on-Server-2016/m-p/540173/highlight/true#M7187. Cheers, - Jo.

jho-splunk · ‎06-03-2023

Hey @jmancyber, Oh, that's a great find. Thanks for reporting back, it's always helpful! Cheers, - Jo.

jho-splunk · ‎05-25-2023

Hi @jmancyber, Well, it looks like msiexec.exe doesn't think it exists. Are you maybe assuming something about the current working directory that may not be true? Cheers, - Jo.

jho-splunk · ‎05-25-2023

Hi @jmancyber, Oh dear. Is this an upgrade? Does this file exist: C:\IntunePacker\SourceSplunk\splunkforwarder.msi? Cheers, - Jo.

jho-splunk · ‎05-24-2023

Hi @jmancyber, Have you tried enabling logging (something like: /l*vx msiexec.log)? Does it acknowledge those parameters as being set? What's the last thing it does just before it fails (search for "return value 3"). Cheers, - Jo.

jho-splunk · ‎05-22-2023

Hmmm...interesting. That should be implied, but thanks for letting us know!

jho-splunk · ‎05-22-2023

Hi @rmn, Ah ok! Well, based on that description, it definitely sounds like something is going wrong. I would say that your best bet is to contact Splunk Support. Cheers, - Jo.

jho-splunk · ‎05-22-2023

Hi @rmn, Well, it should restart in these situations based on the logging...so I'm not sure I follow now. Are you saying that it then continually restarts like every minute or something like that? Cheers, - Jo.

jho-splunk · ‎05-21-2023

Hi @mk_ultra, Please see the following reply for instructions on how to troubleshoot: https://community.splunk.com/t5/Installation/Install-issue-on-Server-2016/m-p/540173/highlight/true#... Cheers, - Jo.

jho-splunk · ‎05-21-2023

Hi @rmn, So are you saying that when this happens, Splunk does not automatically restart? Cheers, - Jo.

jho-splunk · ‎05-21-2023

Hi @SvenBirke, I can confirm that the Splunk Windows Installer package does not do anything special on servers that are running Exchange. Were you able to follow the instructions in the link I posted above? Cheers, - Jo.

jho-splunk · ‎02-03-2023

Hi @chuckbuford, I'm pretty sure the linked answer is the issue, it's just that the culprit here will be a different key that doesn't contain a ProductName value. Are you on the Splunk-Usergroups Slack, perchance? Feel free to hit me up there. Otherwise I would suggest that you open a case with Support. Cheers, - Jo.

jho-splunk · ‎02-03-2023

Hi @chuckbuford, Please see here: https://community.splunk.com/t5/Getting-Data-In/unable-to-install-universal-forwarder-windows-10/td-p/491934. Cheers, - Jo.

jho-splunk · ‎11-10-2022

Hi @rajyah, I'm afraid we'll need a Process Monitor log to troubleshoot this further, but unfortunately they're too big to attach here so I'd suggest opening a case with Splunk Support. Cheers, - Jo.

jho-splunk · ‎10-03-2022

Hi @herberthebia, This question may provide some pointers on troubleshooting/solving: Solved: Re: New Install of Splunk - Rollback occurs near t... - Splunk Community. Also, is is possible that the LOGON_PASSWORD has any punctuation characters in it that may be interpreted by the cmd shell? Cheers, - Jo.

jho-splunk · ‎09-15-2022

Hi @linspec9721 , To troubleshoot this further we'd need a Process Monitor log file to see what the _py_internal command was doing before it failed. It's not possible to share a PML here though, so I'd suggest opening a Support case. Cheers, - Jo.

jho-splunk · ‎09-14-2022

Hi @trtracy , Aha! > net helpmsg (0x421) The account name is invalid or does not exist, or the password is invalid for the account name specified. So the logon username and/or password are incorrect. Are you supplying the full domain user account name (e.g., "ACMECORP\splunk-service" and not just "splunk-service")? Cheers, - Jo.

jho-splunk · ‎09-13-2022

Hi @trtracy , Please see the following reply for instructions on how to troubleshoot: https://community.splunk.com/t5/Installation/Install-issue-on-Server-2016/m-p/540173/highlight/true#... Cheers, - Jo.

jho-splunk · ‎08-25-2022

Hi @lukrator, This is an unusual error—I have not encountered it before. To troubleshoot further, I think that we may need to get a Procmon log. Are you able to open a ticket with Support? Cheers, - Jo.

jho-splunk · ‎06-20-2022

Hi @lalit375, Are there any ERRORs or WARNs in splunkd.log around the time that the installer attempts to start the UF service? Cheers, - Jo.

Posts	54
Solutions	6
Karma Given	3
Karma Received	10
Member Since	‎09-03-2020

Online Status	Offline
Date Last Visited	‎02-08-2024 03:43 AM

Re: Why does Windows Splunk upgrade to from versio...

Re: Universal Forwarder Setup Wizard Ended Prematu...

Re: I cannot install splunk on windows

Re: Why does Splunk upgrade to version 9.1.0.1 end...

Re: Splunk upgrade to version 9.1.0.1 ends prematu...

Re: Splunk upgrade to version 9.1.0.1 ends prematu...

Re: Powershell Universal Forwarder Installation no...

Re: Powershell Universal Forwarder Installation no...

Re: Powershell Universal Forwarder Installation no...

Re: Powershell Universal Forwarder Installation no...

Re: Domain controllers not taking SCCM installatio...

Re: Why is Splunk Universal Forwarder shutting dow...

Re: Why is Splunk Universal Forwarder shutting dow...

Re: Domain controllers not taking SCCM installatio...

Re: Why is Splunk Universal Forwarder shutting dow...

Re: How do I fix this automatic installation fails...

Re: How do I fix this automatic installation fails...

Re: How do I fix this automatic installation fails...

Re: Difficulty on installing Splunk UF 8.2.4 on Se...

Re: Deploy Splunk Universal Forwarder via the scri...

Re: Splunk Ent. for Windows rollback during upgra...

Re: New Install of Splunk - Rollback occurs near t...

Re: New Install of Splunk - Rollback occurs near t...

Re: Why is Splunk Update (7.4.3 > 8.0.0) failing: ...

Re: Why unable to install splunkforwarder-8.2.2-87...