The only way I have been able to successfully install Splunk Enterprise on Windows and have the services start (splunk-6.1.3-220630-x64-release) is to NOT change the default installation location. I tried many variations (local user, AD user, fresh Windows Server 2008 R2, fully patched Windows Server 2008 R2, AD joined, non-AD joined, etc.) until I finally just used defaults (Next > Next > Next > Finish) and found success. I then created a new Windows Server 2008 R2 Standard instance, added it to the AD domain, added a splunk service user to the local administrators group, and then installed Splunk Enterprise successfully using defaults except for the AD user.
... View more