The error is "Error writing to file: C:\ProgramFiles|Splunk\share\splunk\search_mrsparkle\exposed\js\shim\splunk.pdf.js." The second part of my message is what I have done to try to solve the issue ("I tried, with no success, to modify permission, on security tab, of the properties of the folder."). ... View more

What error? ... View more

Hi Jo, I installed and runned Sysinternals' Process Monitor. What, specifically, should I look for? ... View more

I have not Linux OS, I have problem only with my windows laptop that I use in office. In the past I installed Splunk on my private laptop without any problems. ... View more

Hi woodcock, I tried to install in the root of the drive but I have the same error ... View more

Hi nareshinsvu, is first installation on this PC. Yes, I tried also with older version but with same result. Cheers Nicolò ... View more

MSI (c) (20:6C) [16:52:21:281]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi' against software restriction policy MSI (c) (20:6C) [16:52:21:281]: SOFTWARE RESTRICTION POLICY: C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi has a digital signature MSI (c) (20:6C) [16:52:26:078]: SOFTWARE RESTRICTION POLICY: C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi is permitted to run at the 'unrestricted' authorization level. MSI (c) (20:6C) [16:52:26:663]: Original package ==> C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi MSI (c) (20:6C) [16:52:26:663]: Package we're running from ==> C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi MSI (c) (20:6C) [16:52:26:767]: Package name extracted from package path: 'splunk-7.3.1-bd63e13aa157-x64-release.msi' MSI (c) (20:6C) [16:52:26:805]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi'. MSI (c) (20:6C) [16:52:26:805]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi'. MSI (s) (C8:3C) [16:52:59:022]: Running installation inside multi-package transaction C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi ... View more

Hi Jo, Sorry I find "Return Value 3": Property(S): OriginalDatabase = C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi Property(S): UILevel = 5 Property(S): Preselected = 1 Property(S): CostingComplete = 1 Property(S): OutOfDiskSpace = 0 Property(S): OutOfNoRbDiskSpace = 0 Property(S): PrimaryVolumeSpaceAvailable = 0 Property(S): PrimaryVolumeSpaceRequired = 0 Property(S): PrimaryVolumeSpaceRemaining = 0 Property(S): SOURCEDIR = C:\Users\gerosan\ Property(S): SourcedirProduct = {562A3BD0-3B05-4C80-A93F-0AA1AD74E79F} Property(S): ProductToBeRegistered = 1 MSI (s) (C8:D4) [17:04:35:885]: MainEngineThread is returning 1603 MSI (s) (C8:3C) [17:04:35:893]: User policy value 'DisableRollback' is 0 MSI (s) (C8:3C) [17:04:35:893]: Machine policy value 'DisableRollback' is 0 MSI (s) (C8:3C) [17:04:35:893]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (C8:3C) [17:04:35:894]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (C8:3C) [17:04:35:894]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (C8:3C) [17:04:35:895]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (s) (C8:3C) [17:04:35:895]: Restoring environment variables MSI (s) (C8:3C) [17:04:35:896]: Destroying RemoteAPI object. MSI (s) (C8:14) [17:04:35:896]: Custom Action Manager thread ending. MSI (c) (20:6C) [17:04:35:898]: Back from server. Return value: 1603 MSI (c) (20:6C) [17:04:35:898]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (c) (20:6C) [17:04:35:898]: PROPERTY CHANGE: Deleting SECONDSEQUENCE property. Its current value is '1'. Action ended 17:04:35: ExecuteAction. Return value 3 I tried to run the command: Get-FileHash splunk-7.3.1-bd63e13aa157-x64-release.msi but the result is that this command is not recognize as internal or external command. For the full path of the error I'm not secure that is C:\ProgramFiles|Splunk\share\ or C:\Program Files|Splunk\share\ because the message goes to new line immediatly after C:\Program ... View more

Sorry Jo, I found "Return Value 3": Property(S): OriginalDatabase = C:\Users\gerosan\splunk-7.3.1-bd63e13aa157-x64-release.msi Property(S): UILevel = 5 Property(S): Preselected = 1 Property(S): CostingComplete = 1 Property(S): OutOfDiskSpace = 0 Property(S): OutOfNoRbDiskSpace = 0 Property(S): PrimaryVolumeSpaceAvailable = 0 Property(S): PrimaryVolumeSpaceRequired = 0 Property(S): PrimaryVolumeSpaceRemaining = 0 Property(S): SOURCEDIR = C:\Users\gerosan\ Property(S): SourcedirProduct = {562A3BD0-3B05-4C80-A93F-0AA1AD74E79F} Property(S): ProductToBeRegistered = 1 MSI (s) (C8:D4) [17:04:35:885]: MainEngineThread is returning 1603 MSI (s) (C8:3C) [17:04:35:893]: User policy value 'DisableRollback' is 0 MSI (s) (C8:3C) [17:04:35:893]: Machine policy value 'DisableRollback' is 0 MSI (s) (C8:3C) [17:04:35:893]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (C8:3C) [17:04:35:894]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (C8:3C) [17:04:35:894]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (C8:3C) [17:04:35:895]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (s) (C8:3C) [17:04:35:895]: Restoring environment variables MSI (s) (C8:3C) [17:04:35:896]: Destroying RemoteAPI object. MSI (s) (C8:14) [17:04:35:896]: Custom Action Manager thread ending. MSI (c) (20:6C) [17:04:35:898]: Back from server. Return value: 1603 MSI (c) (20:6C) [17:04:35:898]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (c) (20:6C) [17:04:35:898]: PROPERTY CHANGE: Deleting SECONDSEQUENCE property. Its current value is '1'. Action ended 17:04:35: ExecuteAction. Return value 3 ... View more

Hi Jo, I tried to install using your command but in the msiexec.log there is no "Return value 3"; I find only "Return value 1". The complete error is: "Error writing to file: C:\ProgramFiles|Splunk\share\splunk\search_mrsparkle\exposed\js\shim\splunk.pdf.js. Verify that you have access to that directory." There is no folder, before installing Splunk, with "Splunk" as name. Cheers Nicolò ... View more

Hi Jo, it's first installation on this PC. Cheers Nicolò ... View more

I resolve changing <eval token="startSearch">random()</eval> with <set token="startSearch">random()</set> ... View more

<dashboard> <label>test</label> <search> <query> index="test" | eval id=value1.ALARMDATE | search id="$click.value$" | eval acknowledged="true" | table id _time ALARMDATE DEFTIME value1 ACK acknowledged | collect index="test" | eval runMe = "$startSearch$" </query> </search> <row> <panel> <table> <search> <query>index="test" | eval id=value1.ALARMDATE | dedup id | eval ACK="ACK" | table id _time ALARMDATE DEFTIME value1 ACK acknowledged</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <eval token="startSearch">random()</eval> </drilldown> </table> </panel> </row> </dashboard> This is how I implemented your suggestion but it doesn't work. I don't understand how I can pass the "id" value from a click.value command. Thanks! ... View more

Hi nick, I didn't find what 0.0 means as a result of pingdelay. If I run a search with pingdelay sometimes the result is 0.0026 sometimes, for the same IP address, is 0.0 and if I try to ping via cmd the result is a succesfully ping. Can you help me to find the cause? ... View more

Hi nick405060, now it seems that something works but for some IP address, the results of pingdelay is 0.0. Why am I getting this results? ... View more

How I can run as root the Splunk Instance? I already install the app pingstatus on another splunk and I can't run the app. ... View more

How I can accept? ... View more

Yes! Now it's working! Thanks a lot! ... View more

Hi logloganathan, i already installed the pingstatus app, my question is how to incorparate the ping command to a existing dashboard. i would like to ping several IP address that I know only when I run a search ... View more

Hi Ansif, with PINGSTATUS app how I can ping the IP address directly from my dashboard that have as results the example above? ... View more