Getting Data In

Why does the Splunkd and Splunkweb service not install?

ndoshi
Splunk Employee
Splunk Employee

On 64 bit Windows, if the download is correct (64 bit), the user is running as Administrator, Splunk is installed as the local service user, and ports 8000 and 8089 are free, what are possible causes of this error message, after Splunk is installed?

Service Manager Failed to open 'Splunkd'. The specified Service does not exist as an installed Service.

Service Manager Failed to open 'Splunkweb'. The specified Service does not exist as an installed Service.

0 Karma

rexxxus
New Member

for me the msiexec.exe logs didn't work..

but i found out that splunk requires a functional WMI to install the services. you can check your WMI here: windows link in german (its a german windows site but there should be a similar one in english somewhere..)

sorry for my bad english it's not my native language..

0 Karma

timnj
New Member

I had a similar issue; the installation process would hang for a long time while my AV (Kaspersky) decided to hog the CPU, then the two error messaegs described would pop up.

On viewing the quarantine area for the AV, there was c:\Program Files\Splunk\Bin\Python.exe.

I attempted the install again, pausing the AV beforehand, and it worked a treat.

This isn't specific to 32- or 64-bit machines, but it's another option to look at for anyone having this problem.

0 Karma

wolmex
New Member

I have some problem:

Install using: msiexec.exe /i Splunk.msi INSTALLDIR="c:\arquivos de programas\splunk" SPLUNKD_PORT=8081 WEB_PORT=8082 WINEVENTLOGAPPCHECK=1 WINEVENTLOGSECCHECK=1 WINEVENTLOGSYSCHECK=1 WINEVENTLOGFWDCHECK=1 WINEVENTLOGSETCHECK=1 IS_NET_API_LOGON_USERNAME="XXX\xxxxxx" IS_NET_API_LOGON_PASSWORD="xxx" SPLUNK_APP="" LAUNCHSPLUNK=1 AUTOSTARTSERVICE_SPLUNKD=1 AUTOSTARTSERVICE_SPLUNKWEB=1 AUTOSTARTSERVICE=1 /quiet

and only:

msiexec.exe /i Splunk.msi

Starting:

Traceback (most recent call last):
File "C:\Arquivos de programas\splunk\Python-2.6\Lib\site-packages\splunk\clil ib\cli.py", line 18, in
import control_api as ca
File "C:\Arquivos de programas\splunk\Python-2.6\Lib\site-packages\splunk\clil ib\control_api.py", line 16, in
import clean
File "C:\Arquivos de programas\splunk\Python-2.6\Lib\site-packages\splunk\clil ib\clean.py", line 9, in
import splunk.windows as win
File "C:\Arquivos de programas\splunk\Python-2.6\Lib\site-packages\splunk\wind ows.py", line 3, in
import wmi, json
File "C:\Arquivos de programas\splunk\Python-2.6\Lib\site-packages\wmi.py", li ne 169, in
obj = GetObject ("winmgmts:")
File "C:\Arquivos de programas\splunk\Python-2.6\Lib\site-packages\win32com\cl ient_init_.py", line 73, in GetObject
return Moniker(Pathname, clsctx)
File "C:\Arquivos de programas\splunk\Python-2.6\Lib\site-packages\win32com\cl ient_init_.py", line 88, in Moniker
moniker, i, bindCtx = pythoncom.MkParseDisplayName(Pathname) pywintypes.com_error: (-2147217406, 'OLE error 0x80041002', None, None)

0 Karma

briang67
Communicator

I've run into this exact same issue and it turned out that the culprit was a corrupt wmi repository.

It seems that the -2147217406, 'OLE error 0x80041002' python error is related to win32net.NetUserGetInfo that I believe the installer is using to get profile info for the ID being used for the install.

Running wmidiag I could see there was a problem with obtaining a handle on the root object. After rebuilding wmi the problem went away and I was able to install splunk.

0 Karma

blueflhx
New Member

even running as administrator doesn't help. I still can't get splunk-4.1.3-80534-x86-release.msi to install splunkd or splunkweb. What's up ?

0 Karma

apro
Path Finder

I am facing the same problem..

I am using domain admin to install splunk on both domain controllers running win2k3.

When installation I have checked user as "local system user" to install..

Any ideas?

0 Karma

hotloomis
New Member

I thought the same. I am admin on the host (32 bit wintel.) It just never installs the service. I can manually create services with other processes/installs.

here is the error i am gettign when starting Splunk manually:

D:\Splunk\bin>splunk start Traceback (most recent call last): File "D:\Splunk\Python-2.6\Lib\site-packages\splunk\clilib\cli.py", line 18, in import control_api as ca File "D:\Splunk\Python-2.6\Lib\site-packages\splunk\clilib\control_api.py", line 16, in import clean File "D:\Splunk\Python-2.6\Lib\site-packages\splunk\clilib\clean.py", line 9, in import splunk.windows as win File "D:\Splunk\Python-2.6\Lib\site-packages\splunk\windows.py", line 3, in import wmi, json File "D:\Splunk\Python-2.6\Lib\site-packages\wmi.py", line 169, in obj = GetObject ("winmgmts:") File "D:\Splunk\Python-2.6\Lib\site-packages\win32com\client_init_.py", line 73, in GetObject return Moniker(Pathname, clsctx) File "D:\Splunk\Python-2.6\Lib\site-packages\win32com\client_init_.py", line 88, in Moniker moniker, i, bindCtx = pythoncom.MkParseDisplayName(Pathname) pywintypes.com_error: (-2147217406, 'OLE error 0x80041002', None, None)

D:\Splunk\bin>

0 Karma

Mick
Splunk Employee
Splunk Employee

Sounds to me that the services didn't install properly, but that's just stating the obvious.

Every MSI installation should write a log file in %temp%, if there are any problems/errors during installation they should be recorded there. This smells like a permissions issue to me, have you tried installing as the 'Local System User'?

One of the requirements of the 'User' Splunk runs as, is that User needs to have the 'Run as a Service' capability. From what I see here, it sounds like your Admin user doesn't have this permission. You can create a service, but that's a different function.

ndoshi
Splunk Employee
Splunk Employee

Logging options for msiexec.exe would be:

Logging Options
/l[i|w|e|a|r|u|c|m|o|p|v|x|+|!|*]
i - Status messages
w - Nonfatal warnings
e - All error messages
a - Start up of actions
r - Action-specific records
u - User requests
c - Initial UI parameters
m - Out-of-memory or fatal exit information
o - Out-of-disk-space messages
p - Terminal properties
v - Verbose output
x - Extra debugging information
+ - Append to existing log file
! - Flush each line to the log
* - Log all information, except for v and x options
/log

gkanapathy
Splunk Employee
Splunk Employee

You can also run the MSI with a much more detailed logging. If you start up msiexec.exe, it will give you a list of flags you can use. Turn on the most you can, set an output file, and try installing under those.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...