i have the exact same issue, doing a one time import of a simple four row text test CSV file without a header and Splunk insists the top row is the header which it is not, I am a web interface GUI junkie so would love to know how to fix this using the GUI on a Windows platform not Unix not editing any wild text files ... View more

ah that makes sense, thank you so much, hugely appreciate it, and as a reward for good work here is more work ie more dumb questions so when I attempted to simply just reingest it as a CSV it never showed me the raw data in the preivew of the import wizard like it did the first time, I found that to be odd so I changed the source type to Miscellaneous \ generic_single_line and then it showed all four rows looking like most of the data we ingest from all over the place and who knows what types of logs then for the hewk of it I tried ingesting it again as a CSV and whalla it once again showed the Raw data, thanks alot Splunk your inconsistencies are driving me bananas  ... View more

shoot mine is doing the opposite, I have a CSV with no header row, and it is using the first row of data as a header, how do I make it stop, lol  ... View more

this is like defining a word you don't know the meaning of with another word you don't know the meaning of ... View more

not sure about that, but we are having major issues after the upgrade to 9.2.1 with both of our Deployment Servers (running on Windows Server 2019)  one server is only supposed to show us Servers and the other is only supposed to show us our Workstations but now they are comingled on both, this poses a major problem as apps meant for servers may end up being installed on the Workstations and vice versa  we opened a Technical Support case on this a week ago and will let you know how it goes, so far their work arounds are not fixing anything for us ... View more

I don't like abandoned threads, so after hours and hours with Splunk Tech Support and having opened multiple cases on this issue I have something worth sharing. You may need to do Two things to get this to work / install: First Part 1.  using the command line stop Splunk from running, so run SPLUNK STOP on Windows it may look somethign like this C:\Program Files\Splunk\bin>splunk stop 2. then run the install MSI with the LAUNCHSPLUNK=0 parameter (no it does not have to be all in caps, not on Windows anyways) C:\Software\Splunk>splunk-9.1.1-64e843ea36b1-x64-release.msi launchsplunk=0   Alright, that may get it installed, but afterwards you will notice it does not want to start, but that's ok, I will show you what to do to get it to start in the follow up post.   ... View more

looks like people were having the same problem six years ago   https://community.splunk.com/t5/Building-for-the-Splunk-Platform/Rollback-during-Installation-Windows-64-bit/m-p/335020/highlight/false#M4994       ... View more

same problem six years later attempting to upgrade from version 9.0.0 to 9.1.1 on half of our servers it upgraded fine on the other half it chokes     Rollback: StopSplunkServiceDef MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=StopSplunkServiceDef,,) Rollback: RestartSplunkService MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=RestartSplunkService,,) MSI (s) (B4:98) [22:00:59:416]: Executing op: CustomActionRollback(Action=RestartSplunkService,ActionType=1281,Source=BinaryData,Target=StartSplunkServiceCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;SplunkSvcName=Splunkd;LaunchSplunk=1;FailCA=) MSI (s) (B4:BC) [22:00:59:478]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIDCBF.tmp, Entrypoint: StartSplunkServiceCA StartSplunkService: Warning: Invalid property ignored: FailCA=. StartSplunkService: Info: Properties: splunkHome: C:\Program Files\Splunk, svcName: Splunkd, launch splunk: 1. StartSplunkService: Info: Enter. StartSplunkService: Info: service Splunkd already exists StartSplunkService: Info: Leave. StartSplunkService: Info: Enter. Args: "C:\Program Files\Splunk\bin\splunk.exe", start --answer-yes --no-prompt --accept-license --auto-ports StartSplunkService: Info: SystemPath is: C:\Windows\system32\ StartSplunkService: Info: Execute string: C:\Windows\system32\cmd.exe /c ""C:\Program Files\Splunk\bin\splunk.exe" start --answer-yes --no-prompt --accept-license --auto-ports >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" StartSplunkService: Info: WaitForSingleObject returned : 0x0 StartSplunkService: Info: Exit code for process : 0x1 StartSplunkService: Info: Leave. StartSplunkService: Error: ExecCmd failed: 0x1. StartSplunkService: Error 0x80004005: Cannot start splunkd service. CustomAction RestartSplunkService returned actual error code 1603 but will be translated to success due to continue marking Rollback: Updating component registration ... View more

Rollback: StopSplunkServiceDef MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=StopSplunkServiceDef,,) Rollback: RestartSplunkService MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=RestartSplunkService,,) MSI (s) (B4:98) [22:00:59:416]: Executing op: CustomActionRollback(Action=RestartSplunkService,ActionType=1281,Source=BinaryData,Target=StartSplunkServiceCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;SplunkSvcName=Splunkd;LaunchSplunk=1;FailCA=) MSI (s) (B4:BC) [22:00:59:478]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIDCBF.tmp, Entrypoint: StartSplunkServiceCA StartSplunkService: Warning: Invalid property ignored: FailCA=. StartSplunkService: Info: Properties: splunkHome: C:\Program Files\Splunk, svcName: Splunkd, launch splunk: 1. StartSplunkService: Info: Enter. StartSplunkService: Info: service Splunkd already exists StartSplunkService: Info: Leave. StartSplunkService: Info: Enter. Args: "C:\Program Files\Splunk\bin\splunk.exe", start --answer-yes --no-prompt --accept-license --auto-ports StartSplunkService: Info: SystemPath is: C:\Windows\system32\ StartSplunkService: Info: Execute string: C:\Windows\system32\cmd.exe /c ""C:\Program Files\Splunk\bin\splunk.exe" start --answer-yes --no-prompt --accept-license --auto-ports >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" StartSplunkService: Info: WaitForSingleObject returned : 0x0 StartSplunkService: Info: Exit code for process : 0x1 StartSplunkService: Info: Leave. StartSplunkService: Error: ExecCmd failed: 0x1. StartSplunkService: Error 0x80004005: Cannot start splunkd service. CustomAction RestartSplunkService returned actual error code 1603 but will be translated to success due to continue marking Rollback: Updating component registration ... View more

ok, did just that and here is a section from the install log where things go south and setup begins rolling back MSI (s) (FC:F4) [12:47:17:625]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIF1EF.tmp, Entrypoint: StopSplunkServiceDefCA MSI (s) (FC:68) [12:47:17:625]: Generating random cookie. MSI (s) (FC:68) [12:47:17:625]: Created Custom Action Server with PID 2452 (0x994). MSI (s) (FC:70) [12:47:17:719]: Running as a service. MSI (s) (FC:70) [12:47:17:719]: Hello, I'm your 64bit Elevated Non-remapped custom action server. StopSplunkServiceDef: Warning: Invalid property ignored: FailCA=. StopSplunkServiceDef: Info: Properties: splunkHome: C:\Program Files\Splunk, svcName: Splunkd. StopSplunkServiceDef: Info: Enter. StopSplunkServiceDef: Info: service Splunkd already exists StopSplunkServiceDef: Info: Leave. MSI (s) (FC:F4) [12:47:17:734]: Executing op: ActionStart(Name=ReinstallRegmonDrv,,) Action 12:47:17: ReinstallRegmonDrv. MSI (s) (FC:F4) [12:47:17:734]: Executing op: CustomActionSchedule(Action=ReinstallRegmonDrv,ActionType=1281,Source=BinaryData,Target=InstallRegmonDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:F4) [12:47:17:750]: Executing op: ActionStart(Name=UninstallNetmonDrv,,) Action 12:47:17: UninstallNetmonDrv. MSI (s) (FC:F4) [12:47:17:750]: Executing op: CustomActionSchedule(Action=UninstallNetmonDrv,ActionType=3073,Source=BinaryData,Target=UninstallNetmonDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:14) [12:47:17:812]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIF2AB.tmp, Entrypoint: UninstallNetmonDrvCA UninstallNetmonDrv: Warning: Invalid property ignored: FailCA=. UninstallNetmonDrv: Info: Driver inf file: C:\Program Files\Splunk\bin\splknetdrv.inf. UninstallNetmonDrv: Info: Enter. UninstallNetmonDrv: Info: Service: splknetdrv, state: 1. UninstallNetmonDrv: Info: splknetdrv service does not exists. UninstallNetmonDrv: Info: Enter. Args: rundll32.exe, setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\splknetdrv.inf UninstallNetmonDrv: Info: SystemPath is: C:\Windows\system32\ UninstallNetmonDrv: Info: Execute string: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\splknetdrv.inf >> "C:\Users\MUSZYN~1\AppData\Local\Temp\splunk.log" 2>&1" UninstallNetmonDrv: Info: WaitForSingleObject returned : 0x0 UninstallNetmonDrv: Info: Exit code for process : 0x0 UninstallNetmonDrv: Info: Leave. MSI (s) (FC:F4) [12:47:18:390]: Executing op: ActionStart(Name=ReinstallNohandleDrv,,) Action 12:47:18: ReinstallNohandleDrv. MSI (s) (FC:F4) [12:47:18:390]: Executing op: CustomActionSchedule(Action=ReinstallNohandleDrv,ActionType=1281,Source=BinaryData,Target=InstallNohandleDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:F4) [12:47:18:390]: Executing op: ActionStart(Name=UninstallRegmonDrv,,) Action 12:47:18: UninstallRegmonDrv. MSI (s) (FC:F4) [12:47:18:406]: Executing op: CustomActionSchedule(Action=UninstallRegmonDrv,ActionType=3073,Source=BinaryData,Target=UninstallRegmonDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:50) [12:47:18:453]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIF53D.tmp, Entrypoint: UninstallRegmonDrvCA UninstallRegmonDrv: Warning: Invalid property ignored: FailCA=. UninstallRegmonDrv: Info: Driver inf file: C:\Program Files\Splunk\bin\splunkdrv.inf. UninstallRegmonDrv: Info: Enter. UninstallRegmonDrv: Info: Service: splunkdrv, state: 1. UninstallRegmonDrv: Info: splunkdrv service does not exists. UninstallRegmonDrv: Info: Enter. Args: rundll32.exe, setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\splunkdrv.inf UninstallRegmonDrv: Info: SystemPath is: C:\Windows\system32\ UninstallRegmonDrv: Info: Execute string: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\splunkdrv.inf >> "C:\Users\MUSZYN~1\AppData\Local\Temp\splunk.log" 2>&1" UninstallRegmonDrv: Info: WaitForSingleObject returned : 0x0 UninstallRegmonDrv: Info: Exit code for process : 0x0 UninstallRegmonDrv: Info: Leave. MSI (s) (FC:F4) [12:47:19:031]: Executing op: ActionStart(Name=ReinstallNetmonDrv,,) Action 12:47:19: ReinstallNetmonDrv. MSI (s) (FC:F4) [12:47:19:047]: Executing op: CustomActionSchedule(Action=ReinstallNetmonDrv,ActionType=1281,Source=BinaryData,Target=InstallNetmonDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:F4) [12:47:19:047]: Executing op: ActionStart(Name=UninstallNohandleDrv,,) Action 12:47:19: UninstallNohandleDrv. MSI (s) (FC:F4) [12:47:19:047]: Executing op: CustomActionSchedule(Action=UninstallNohandleDrv,ActionType=3073,Source=BinaryData,Target=UninstallNohandleDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:88) [12:47:19:094]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIF7BE.tmp, Entrypoint: UninstallNohandleDrvCA UninstallNohandleDrv: Warning: Invalid property ignored: FailCA=. UninstallNohandleDrv: Info: Driver inf file: C:\Program Files\Splunk\bin\SplunkMonitorNoHandleDrv.inf. UninstallNohandleDrv: Info: Enter. UninstallNohandleDrv: Info: Service: SplunkMonitorNoHandle, state: 1. UninstallNohandleDrv: Info: SplunkMonitorNoHandle service does not exists. UninstallNohandleDrv: Info: Enter. Args: rundll32.exe, setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\SplunkMonitorNoHandleDrv.inf UninstallNohandleDrv: Info: SystemPath is: C:\Windows\system32\ UninstallNohandleDrv: Info: Execute string: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\SplunkMonitorNoHandleDrv.inf >> "C:\Users\MUSZYN~1\AppData\Local\Temp\splunk.log" 2>&1" UninstallNohandleDrv: Info: WaitForSingleObject returned : 0x0 UninstallNohandleDrv: Info: Exit code for process : 0x0 UninstallNohandleDrv: Info: Leave. MSI (s) (FC:F4) [12:47:19:703]: Executing op: ActionStart(Name=RemoveFiles,Description=Removing files,Template=File: [1], Directory: [9]) Action 12:47:19: RemoveFiles. Removing files MSI (s) (FC:F4) [12:47:19:703]: Executing op: ProgressTotal(Total=17609,Type=1,ByteEquivalent=175000) MSI (s) (FC:F4) [12:47:19:703]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Splunk Enterprise\) ... View more

thank you Rich for taking the time to comment, I agree with you however please check your own config as what I see is that Splunk runs it's own apps as Nobody, for example these: Splunk_Security_Essentials SplunkAppForWebAnalytics Splunk_ML_Toolkit Splunk_TA_microsoft-cloudservices Splunk_TA_microsoft-sqlserver splunk_instrumentation search splunk_monitoring_console sideview_utils simple_xml_examples splunk_archiver ... View more

same issue here 5 years later in 2023 on version 9.0.0 on a Windows platform, no clue what causes these random issues, we always put Splunk in maintenance mode when patching or doing any sort of maintenance, we do have an Index Cluster and it's a PIA      ... View more

I don't understand the point of this link, it literally just takes us to the online Managing Indexers and Clusters of Indexers manual Use maintenance mode section    ... View more

I realize this is an old thread but rather than starting a new one for the exact same issue I want to use this to show some history, it is 2023 now and we are on version 9.0.0 on a Windows platform and are still getting this same exact error I have opened a technical support case with Splunk and hope to provide you with updates, troubleshooting tips and hopefully a proper solution for this issue  Note: in my case I found the "missing" buckets on the Index Cluster Master UI under Settings \ Index clustering \  Bucket Status \ Fix Up Tasks section     ... View more

you are right I am sorry, before I post the full query I just want to say that this report used to work and we made no changes to the query or to the report and just this one field out of six stopped populating  ... View more