There are a number of issues with the way that |delete works in an indexer cluster in 6.5.2. You might want to upgrade to 6.5.4, which contains fixes for SPL-100516/SPL-136735 [Events deleted in an index cluster via the delete search operator may be inconsistently deleted on secondaries] and SPL-140333 [Disappearing cold bucket directories can wedge IndexerService thread (and others) while calculating bucket checksums].
... View more
Hi,
To assist further we're going to need an Installer log. The command to use is:
msiexec /i splunk.msi /l*vx msiexec.log
If you can get us a copy of the resulting msiexec.log , and also %TEMP%\splunk.log (if it exists), hopefully we'll be able to determine what is going on.
Cheers,
- Jo.
... View more