not sure about that, but we are having major issues after the upgrade to 9.2.1 with both of our Deployment Servers (running on Windows Server 2019)  one server is only supposed to show us Servers and the other is only supposed to show us our Workstations but now they are comingled on both, this poses a major problem as apps meant for servers may end up being installed on the Workstations and vice versa  we opened a Technical Support case on this a week ago and will let you know how it goes, so far their work arounds are not fixing anything for us ... View more

I don't like abandoned threads, so after hours and hours with Splunk Tech Support and having opened multiple cases on this issue I have something worth sharing. You may need to do Two things to get this to work / install: First Part 1.  using the command line stop Splunk from running, so run SPLUNK STOP on Windows it may look somethign like this C:\Program Files\Splunk\bin>splunk stop 2. then run the install MSI with the LAUNCHSPLUNK=0 parameter (no it does not have to be all in caps, not on Windows anyways) C:\Software\Splunk>splunk-9.1.1-64e843ea36b1-x64-release.msi launchsplunk=0   Alright, that may get it installed, but afterwards you will notice it does not want to start, but that's ok, I will show you what to do to get it to start in the follow up post.   ... View more

looks like people were having the same problem six years ago   https://community.splunk.com/t5/Building-for-the-Splunk-Platform/Rollback-during-Installation-Windows-64-bit/m-p/335020/highlight/false#M4994       ... View more

same problem six years later attempting to upgrade from version 9.0.0 to 9.1.1 on half of our servers it upgraded fine on the other half it chokes     Rollback: StopSplunkServiceDef MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=StopSplunkServiceDef,,) Rollback: RestartSplunkService MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=RestartSplunkService,,) MSI (s) (B4:98) [22:00:59:416]: Executing op: CustomActionRollback(Action=RestartSplunkService,ActionType=1281,Source=BinaryData,Target=StartSplunkServiceCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;SplunkSvcName=Splunkd;LaunchSplunk=1;FailCA=) MSI (s) (B4:BC) [22:00:59:478]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIDCBF.tmp, Entrypoint: StartSplunkServiceCA StartSplunkService: Warning: Invalid property ignored: FailCA=. StartSplunkService: Info: Properties: splunkHome: C:\Program Files\Splunk, svcName: Splunkd, launch splunk: 1. StartSplunkService: Info: Enter. StartSplunkService: Info: service Splunkd already exists StartSplunkService: Info: Leave. StartSplunkService: Info: Enter. Args: "C:\Program Files\Splunk\bin\splunk.exe", start --answer-yes --no-prompt --accept-license --auto-ports StartSplunkService: Info: SystemPath is: C:\Windows\system32\ StartSplunkService: Info: Execute string: C:\Windows\system32\cmd.exe /c ""C:\Program Files\Splunk\bin\splunk.exe" start --answer-yes --no-prompt --accept-license --auto-ports >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" StartSplunkService: Info: WaitForSingleObject returned : 0x0 StartSplunkService: Info: Exit code for process : 0x1 StartSplunkService: Info: Leave. StartSplunkService: Error: ExecCmd failed: 0x1. StartSplunkService: Error 0x80004005: Cannot start splunkd service. CustomAction RestartSplunkService returned actual error code 1603 but will be translated to success due to continue marking Rollback: Updating component registration ... View more

Rollback: StopSplunkServiceDef MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=StopSplunkServiceDef,,) Rollback: RestartSplunkService MSI (s) (B4:98) [22:00:59:416]: Executing op: ActionStart(Name=RestartSplunkService,,) MSI (s) (B4:98) [22:00:59:416]: Executing op: CustomActionRollback(Action=RestartSplunkService,ActionType=1281,Source=BinaryData,Target=StartSplunkServiceCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;SplunkSvcName=Splunkd;LaunchSplunk=1;FailCA=) MSI (s) (B4:BC) [22:00:59:478]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIDCBF.tmp, Entrypoint: StartSplunkServiceCA StartSplunkService: Warning: Invalid property ignored: FailCA=. StartSplunkService: Info: Properties: splunkHome: C:\Program Files\Splunk, svcName: Splunkd, launch splunk: 1. StartSplunkService: Info: Enter. StartSplunkService: Info: service Splunkd already exists StartSplunkService: Info: Leave. StartSplunkService: Info: Enter. Args: "C:\Program Files\Splunk\bin\splunk.exe", start --answer-yes --no-prompt --accept-license --auto-ports StartSplunkService: Info: SystemPath is: C:\Windows\system32\ StartSplunkService: Info: Execute string: C:\Windows\system32\cmd.exe /c ""C:\Program Files\Splunk\bin\splunk.exe" start --answer-yes --no-prompt --accept-license --auto-ports >> "C:\Users\ADMINI~1\AppData\Local\Temp\splunk.log" 2>&1" StartSplunkService: Info: WaitForSingleObject returned : 0x0 StartSplunkService: Info: Exit code for process : 0x1 StartSplunkService: Info: Leave. StartSplunkService: Error: ExecCmd failed: 0x1. StartSplunkService: Error 0x80004005: Cannot start splunkd service. CustomAction RestartSplunkService returned actual error code 1603 but will be translated to success due to continue marking Rollback: Updating component registration ... View more

ok, did just that and here is a section from the install log where things go south and setup begins rolling back MSI (s) (FC:F4) [12:47:17:625]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIF1EF.tmp, Entrypoint: StopSplunkServiceDefCA MSI (s) (FC:68) [12:47:17:625]: Generating random cookie. MSI (s) (FC:68) [12:47:17:625]: Created Custom Action Server with PID 2452 (0x994). MSI (s) (FC:70) [12:47:17:719]: Running as a service. MSI (s) (FC:70) [12:47:17:719]: Hello, I'm your 64bit Elevated Non-remapped custom action server. StopSplunkServiceDef: Warning: Invalid property ignored: FailCA=. StopSplunkServiceDef: Info: Properties: splunkHome: C:\Program Files\Splunk, svcName: Splunkd. StopSplunkServiceDef: Info: Enter. StopSplunkServiceDef: Info: service Splunkd already exists StopSplunkServiceDef: Info: Leave. MSI (s) (FC:F4) [12:47:17:734]: Executing op: ActionStart(Name=ReinstallRegmonDrv,,) Action 12:47:17: ReinstallRegmonDrv. MSI (s) (FC:F4) [12:47:17:734]: Executing op: CustomActionSchedule(Action=ReinstallRegmonDrv,ActionType=1281,Source=BinaryData,Target=InstallRegmonDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:F4) [12:47:17:750]: Executing op: ActionStart(Name=UninstallNetmonDrv,,) Action 12:47:17: UninstallNetmonDrv. MSI (s) (FC:F4) [12:47:17:750]: Executing op: CustomActionSchedule(Action=UninstallNetmonDrv,ActionType=3073,Source=BinaryData,Target=UninstallNetmonDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:14) [12:47:17:812]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIF2AB.tmp, Entrypoint: UninstallNetmonDrvCA UninstallNetmonDrv: Warning: Invalid property ignored: FailCA=. UninstallNetmonDrv: Info: Driver inf file: C:\Program Files\Splunk\bin\splknetdrv.inf. UninstallNetmonDrv: Info: Enter. UninstallNetmonDrv: Info: Service: splknetdrv, state: 1. UninstallNetmonDrv: Info: splknetdrv service does not exists. UninstallNetmonDrv: Info: Enter. Args: rundll32.exe, setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\splknetdrv.inf UninstallNetmonDrv: Info: SystemPath is: C:\Windows\system32\ UninstallNetmonDrv: Info: Execute string: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\splknetdrv.inf >> "C:\Users\MUSZYN~1\AppData\Local\Temp\splunk.log" 2>&1" UninstallNetmonDrv: Info: WaitForSingleObject returned : 0x0 UninstallNetmonDrv: Info: Exit code for process : 0x0 UninstallNetmonDrv: Info: Leave. MSI (s) (FC:F4) [12:47:18:390]: Executing op: ActionStart(Name=ReinstallNohandleDrv,,) Action 12:47:18: ReinstallNohandleDrv. MSI (s) (FC:F4) [12:47:18:390]: Executing op: CustomActionSchedule(Action=ReinstallNohandleDrv,ActionType=1281,Source=BinaryData,Target=InstallNohandleDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:F4) [12:47:18:390]: Executing op: ActionStart(Name=UninstallRegmonDrv,,) Action 12:47:18: UninstallRegmonDrv. MSI (s) (FC:F4) [12:47:18:406]: Executing op: CustomActionSchedule(Action=UninstallRegmonDrv,ActionType=3073,Source=BinaryData,Target=UninstallRegmonDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:50) [12:47:18:453]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIF53D.tmp, Entrypoint: UninstallRegmonDrvCA UninstallRegmonDrv: Warning: Invalid property ignored: FailCA=. UninstallRegmonDrv: Info: Driver inf file: C:\Program Files\Splunk\bin\splunkdrv.inf. UninstallRegmonDrv: Info: Enter. UninstallRegmonDrv: Info: Service: splunkdrv, state: 1. UninstallRegmonDrv: Info: splunkdrv service does not exists. UninstallRegmonDrv: Info: Enter. Args: rundll32.exe, setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\splunkdrv.inf UninstallRegmonDrv: Info: SystemPath is: C:\Windows\system32\ UninstallRegmonDrv: Info: Execute string: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\splunkdrv.inf >> "C:\Users\MUSZYN~1\AppData\Local\Temp\splunk.log" 2>&1" UninstallRegmonDrv: Info: WaitForSingleObject returned : 0x0 UninstallRegmonDrv: Info: Exit code for process : 0x0 UninstallRegmonDrv: Info: Leave. MSI (s) (FC:F4) [12:47:19:031]: Executing op: ActionStart(Name=ReinstallNetmonDrv,,) Action 12:47:19: ReinstallNetmonDrv. MSI (s) (FC:F4) [12:47:19:047]: Executing op: CustomActionSchedule(Action=ReinstallNetmonDrv,ActionType=1281,Source=BinaryData,Target=InstallNetmonDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:F4) [12:47:19:047]: Executing op: ActionStart(Name=UninstallNohandleDrv,,) Action 12:47:19: UninstallNohandleDrv. MSI (s) (FC:F4) [12:47:19:047]: Executing op: CustomActionSchedule(Action=UninstallNohandleDrv,ActionType=3073,Source=BinaryData,Target=UninstallNohandleDrvCA,CustomActionData=SystemFolder=C:\Windows\SysWOW64\;System64Folder=C:\Windows\system32\;SplunkHome=C:\Program Files\Splunk\;FailCA=) MSI (s) (FC:88) [12:47:19:094]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIF7BE.tmp, Entrypoint: UninstallNohandleDrvCA UninstallNohandleDrv: Warning: Invalid property ignored: FailCA=. UninstallNohandleDrv: Info: Driver inf file: C:\Program Files\Splunk\bin\SplunkMonitorNoHandleDrv.inf. UninstallNohandleDrv: Info: Enter. UninstallNohandleDrv: Info: Service: SplunkMonitorNoHandle, state: 1. UninstallNohandleDrv: Info: SplunkMonitorNoHandle service does not exists. UninstallNohandleDrv: Info: Enter. Args: rundll32.exe, setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\SplunkMonitorNoHandleDrv.inf UninstallNohandleDrv: Info: SystemPath is: C:\Windows\system32\ UninstallNohandleDrv: Info: Execute string: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultUninstall 128 C:\Program Files\Splunk\bin\SplunkMonitorNoHandleDrv.inf >> "C:\Users\MUSZYN~1\AppData\Local\Temp\splunk.log" 2>&1" UninstallNohandleDrv: Info: WaitForSingleObject returned : 0x0 UninstallNohandleDrv: Info: Exit code for process : 0x0 UninstallNohandleDrv: Info: Leave. MSI (s) (FC:F4) [12:47:19:703]: Executing op: ActionStart(Name=RemoveFiles,Description=Removing files,Template=File: [1], Directory: [9]) Action 12:47:19: RemoveFiles. Removing files MSI (s) (FC:F4) [12:47:19:703]: Executing op: ProgressTotal(Total=17609,Type=1,ByteEquivalent=175000) MSI (s) (FC:F4) [12:47:19:703]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Splunk Enterprise\) ... View more

thank you Rich for taking the time to comment, I agree with you however please check your own config as what I see is that Splunk runs it's own apps as Nobody, for example these: Splunk_Security_Essentials SplunkAppForWebAnalytics Splunk_ML_Toolkit Splunk_TA_microsoft-cloudservices Splunk_TA_microsoft-sqlserver splunk_instrumentation search splunk_monitoring_console sideview_utils simple_xml_examples splunk_archiver ... View more

same issue here 5 years later in 2023 on version 9.0.0 on a Windows platform, no clue what causes these random issues, we always put Splunk in maintenance mode when patching or doing any sort of maintenance, we do have an Index Cluster and it's a PIA      ... View more

I don't understand the point of this link, it literally just takes us to the online Managing Indexers and Clusters of Indexers manual Use maintenance mode section    ... View more

I realize this is an old thread but rather than starting a new one for the exact same issue I want to use this to show some history, it is 2023 now and we are on version 9.0.0 on a Windows platform and are still getting this same exact error I have opened a technical support case with Splunk and hope to provide you with updates, troubleshooting tips and hopefully a proper solution for this issue  Note: in my case I found the "missing" buckets on the Index Cluster Master UI under Settings \ Index clustering \  Bucket Status \ Fix Up Tasks section     ... View more

you are right I am sorry, before I post the full query I just want to say that this report used to work and we made no changes to the query or to the report and just this one field out of six stopped populating  ... View more

Paul you my friend are a Rock Star !!! that's exactly what I needed  ... View more

I ranned this and found some clues     | rest splunk_server=local /servicesNS/-/-/saved/searches | table title eai:acl.app eai:acl.owner search | where match(search,"computers.csv") ... View more

thanks Rich I ran those searches in two separate Splunk environments (the lookup is working in one but not in the other) and got this error in both: No results found. Try expanding the time range.   even after expanding the time range to 30 days I get nothing, plus I don't understand what you are having me do, could you explain please    ... View more

alright this one really bothers me because Splunk is saying we MUST have a branded product called Symantec Endpoint Protection enabled in order to configure Enterprise Security Think about it, do you even own this product?     ... View more