I installed Splunk Universal forwarder on Windows (2008 rc2), but when I tried to upgrade or to uninstall, it failed.
Error 1321. The Installer has insufficient privileges to modify the file D:\Program Files\SplunkUniversalForwarder\etc\system\metadata\default.meta
It seems to be linked to the MSI installer.
I checked the file it's locked, and there are no visible owner or permissions, even windows doesn't know how to display it.
There is a workaround to fix the file permissions :
Manually updates the permissions of the $Splunk$\etc\system\metadata folder prior to upgrading/uninstall the forwarder. Set the folder to "Inherit Permissions from Parent", and after upgrade, the default.meta file was not corrupt.
There is a workaround to fix the file permissions :
Manually updates the permissions of the $Splunk$\etc\system\metadata folder prior to upgrading/uninstall the forwarder. Set the folder to "Inherit Permissions from Parent", and after upgrade, the default.meta file was not corrupt.
If you have a broken instance on the latest version (6.0 currently), and want to fix it without uninstalling, here is a workaround :
previous state : splunkforwarder version 6 with the permission issue
$SPLUNK_HOME\etc\system
to your user or the systemmsiexec /fa splunkforwarder-6.0-*.msi
It worked. I still don't know what causes that. Is is only with MSI installer on the command line ?