Why unable to install splunkforwarder-8.2.2-87344edfcdb4-x64-release.msi on window server 2012 R2?

[lalit375]

Hi Experts,

I am Unable to install splunkforwarder-8.2.2-87344edfcdb4-x64-release.msi on window server 2012 R2. Getting -UF setup Wizard ended prematurely.     

Any help much appreciated !!!!!!!!!

splunk.log file content--- sharing some last lines 

Splunk> The IT Search Engine.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking kvstore port [8191]: open
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from 'C:\Program Files\SplunkUniversalForwarder\splunkforwarder-8.2.2-87344edfcdb4-windows-64-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

SplunkForwarder: Starting (pid 13848)

Timed out waiting for splunkd to start.
8:17:18 AM
C:\Windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd splunkd uninstall >> "C:\Users\asharma\AppData\Local\Temp\splunk.log" 2>&1"
Removing service SplunkForwarder
Service removed
Disabled.
8:17:19 AM
C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\SplunkUniversalForwarder\bin\SplunkMonitorNoHandleDrv.inf >> "C:\Users\asharma\AppData\Local\Temp\splunk.log" 2>&1"
8:17:20 AM
C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\SplunkUniversalForwarder\bin\splknetdrv.inf >> "C:\Users\asharma\AppData\Local\Temp\splunk.log" 2>&1"
8:17:21 AM
C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\SplunkUniversalForwarder\bin\splunkdrv.inf >> "C:\Users\asharma\AppData\Local\Temp\splunk.log" 2>&1"

[lalit375]

Thanks for reply!

Unfortunately UF 7.3.3 also not working on WIN2012 R2. 

[isoutamo]

As Splunk has dropped the support for Windows 2012 and 2012R2 on Splunk UF 8.0.0 older version should work there. Based on that in Your case there are probably something else which cause this issue?

Can you try this to get more detailed log file, why it didn't succeed?

msiexec.exe /i <path to temp>/splunkforwarder-<XXXXX>-x64-release.msi AGREETOLICENSE=yes LAUNCHSPLUNK=no SERVICESTARTTYPE=auto /quiet /l*v install-log.txt

[lalit375]

Thanks for reply

Please find last few lines - from install-log.txt----------

Property(S): ProductToBeRegistered = 1
MSI (s) (0C:60) [13:31:30:958]: Note: 1: 1708
MSI (s) (0C:60) [13:31:30:958]: Note: 1: 2205 2: 3: Error
MSI (s) (0C:60) [13:31:30:958]: Note: 1: 2228 2: 3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1708
MSI (s) (0C:60) [13:31:30:958]: Note: 1: 2205 2: 3: Error
MSI (s) (0C:60) [13:31:30:958]: Note: 1: 2228 2: 3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709
MSI (s) (0C:60) [13:31:30:958]: Product: UniversalForwarder -- Installation failed.

MSI (s) (0C:60) [13:31:30:958]: Windows Installer installed the product. Product Name: UniversalForwarder. Product Version: 7.3.3.0. Product Language: 1033. Manufacturer: Splunk, Inc.. Installation success or error status: 1603.

MSI (s) (0C:60) [13:31:30:975]: Deferring clean up of packages/files, if any exist
MSI (s) (0C:60) [13:31:30:975]: MainEngineThread is returning 1603
MSI (s) (0C:84) [13:31:30:975]: No System Restore sequence number for this installation.
=== Logging stopped: 6/16/2022 13:31:30 ===
MSI (s) (0C:84) [13:31:30:981]: User policy value 'DisableRollback' is 0
MSI (s) (0C:84) [13:31:30:981]: Machine policy value 'DisableRollback' is 0
MSI (s) (0C:84) [13:31:30:981]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (0C:84) [13:31:30:981]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (0C:84) [13:31:30:982]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (0C:84) [13:31:30:982]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (0C:84) [13:31:30:983]: Destroying RemoteAPI object.
MSI (s) (0C:38) [13:31:30:983]: Custom Action Manager thread ending.
MSI (c) (54:DC) [13:31:30:983]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (54:DC) [13:31:30:984]: MainEngineThread is returning 1603
=== Verbose logging stopped: 6/16/2022 13:31:30 ===

Any idea whts error??

Appreciate your help 

[jho-splunk]

Hi @lalit375,

Are there any ERRORs or WARNs in splunkd.log around the time that the installer attempts to start the UF service?

Cheers,

 - Jo.

[isoutamo]

It said already on line 7 that installation has failed. Probably the reason is couple of lines earlier?

[isoutamo]

Have you already UF installed or is this 1st time installation? MSI Error code 1603 could be come e.g.

• No enough right to install (have you administration cmd line in use?)
• No space left on device
• Software has already installed => you should use update option (no /I use instead /update)

Those are probably the most usual reason for code 1603.

[isoutamo]

Hi

I think that then last certified UF version for Windows 2012 R2 was 7.3.3?

https://community.splunk.com/t5/Getting-Data-In/Is-the-universal-forwarder-8-0-supported-on-Windows-... 

r. Ismo

[lalit375]

Thanks for reply!

Unfortunately UF 7.3.3 also not working on WIN20