Hi @nmohammed  and @goelshruti119 , Please see the following reply for instructions on how to troubleshoot: https://community.splunk.com/t5/Installation/Install-issue-on-Server-2016/m-p/540173/highlight/true#... Cheers,    - Jo.   ... View more

Installation by domain admin with current UF fails on the domain controller with error 1603 and there are additional loglines that may be usefull: MSI (s) (F0:34) [08:38:07:344]: Note: 1: 1708 MSI (s) (F0:34) [08:38:07:344]: Note: 1: 2205 2: 3: Error MSI (s) (F0:34) [08:38:07:344]: Note: 1: 2228 2: 3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1708 MSI (s) (F0:34) [08:38:07:344]: Note: 1: 2205 2: 3: Error MSI (s) (F0:34) [08:38:07:344]: Note: 1: 2228 2: 3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709 MSI (s) (F0:34) [08:38:07:344]: Product: UniversalForwarder -- Installation failed. MSI (s) (F0:34) [08:38:07:344]: Das Produkt wurde durch Windows Installer installiert. Produktname: UniversalForwarder. Produktversion: 9.3.0.0. Produktsprache: 1033. Hersteller: Splunk, Inc.. Erfolg- bzw. Fehlerstatus der Installation: 1603. I thought I would attach the complete log for examination, unfortunably not possible here.  Up to the showed lines everything is running good, no hint of missing permissions etc. Any help is appreciated, our project depends on it. ... View more

Hi Gregski, I was able to get Splunk to install via your steps, but it wont start as you mentioned. What steps do I need to do to get the SplunkD service to start. Currently i get a timeout error when attempting to start it via CLI ... View more

Hi @trha_ , Would it be possible to somehow see a copy of this batch file? Cheers,    - Jo. ... View more

So i figured out how to move past this. I had to find the msi product code for the previous 3 versions and then search the registry for them  one by one.  If they exist they will be in the registry under windows installer\"theproductcode" . This entry has neither splunk nor universal forwarder in the string so it was unfound prior to this. Once i deleted the previous entries, i was able to install the new version. ... View more

Windows hardening which cause the issue . Solved after adjust the permissions.  ... View more

It gives the same error when upgrading from Splunk UF 7.1 to Splunk UF 9.0 on windows server 2012 R2. Error 1316. The specified account already exists The mcafee link is broken so cannot see the resolution. Could someone share what registry should I look for and remove it? ... View more

Hi @pagillar, Please see here for instructions on how to troubleshoot further: https://community.splunk.com/t5/Installation/Install-issue-on-Server-2016/m-p/540173/highlight/true#.... Cheers,     - Jo. ... View more

Hi @mofonguero, as I said, disable any personal firewall you have. Then see at "C:\Program Files\Splunk\var\log\splunk" if there's some log file about the installation. Ciao. Giuseppe ... View more

Hey @jmancyber, Oh, that's a great find.  Thanks for reporting back, it's always helpful! Cheers,    - Jo.   ... View more

Hmmm...interesting.  That should be implied, but thanks for letting us know! ... View more

Hi @rmn, Ah ok!  Well, based on that description, it definitely sounds like something is going wrong.  I would say that your best bet is to contact Splunk Support. Cheers,    - Jo.   ... View more

I have fixed my problem by checking if Windows Installer is running. ... View more

Hi @rajyah, I'm afraid we'll need a Process Monitor log to troubleshoot this further, but unfortunately they're too big to attach here so I'd suggest opening a case with Splunk Support. Cheers,    - Jo.   ... View more

Hi @herberthebia, This question may provide some pointers on troubleshooting/solving: Solved: Re: New Install of Splunk - Rollback occurs near t... - Splunk Community. Also, is is possible that the LOGON_PASSWORD has any punctuation characters in it that may be interpreted by the cmd shell?  Cheers,    - Jo.   ... View more

Hi @linspec9721 , To troubleshoot this further we'd need a Process Monitor log file to see what the _py_internal command was doing before it failed.  It's not possible to share a PML here though, so I'd suggest opening a Support case. Cheers,    - Jo.   ... View more

When I supply the domain name I  get invalid account on the dialog box prompting for this information.  I assumed this field for the account name did not like a slash in the name so I continued without it because it went on to the next screen without it.  I assumed incorrectly again that if I'm using the same account to log into the computer that I'm using in this field for the install, it would know I'm a member of that domain.  What I just tested was adding .local to the end of the domain name and worked.  Thank you for finding the solution.  Funny on how some things you do in windows only need the domain name while others need the TLD extension as well such as in this case. ... View more

Hi @lukrator, This is an unusual error—I have not encountered it before.  To troubleshoot further, I think that we may need to get a Procmon log.  Are you able to open a ticket with Support? Cheers,    - Jo.   ... View more

Have you already UF installed or is this 1st time installation? MSI Error code 1603 could be come e.g. No enough right to install (have you administration cmd line in use?) No space left on device Software has already installed => you should use update option (no /I use instead /update) Those are probably the most usual reason for code 1603.   ... View more

Hi @AIOPs_Lite, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the Contributors 😉 ... View more

No, transcription isn't enabled.    Splunk version is 8.1.6. ... View more

Hi @ruchika997, This is likely a permissions problem.  What is the user that you are logged-in as when you do: splunk start  And which user is the Splunk service installed under? Cheers,    - Jo. ... View more

Hi some other useful parameters https://community.splunk.com/t5/Getting-Data-In/AGREETOLICENSE-not-agreeing-Windows10/m-p/449556 r. Ismo ... View more

Hi, in my case there was an application not compatible with Python 3 which I forgot to update (you can check the apps to update with Python Readiness App). Once updated the application, the Splunk upgrade worked as expected. Hope this may help. ... View more

@Stefanie Your script worked well with a few adapations. Thx!  ... View more