Getting Data In

Splunk Universal Forwarder 6.4.1 and all Versions younger than 6.2 cannot be installed to 7 of our systems

christopherr_sp
Splunk Employee
Splunk Employee

 The Error Message on the screen isenter code here: "UniversalForwarder Setup ended prematurely" 

Versions older than 6.2 (e.g. 6.1.3) of Splunk Universal Forwarder and Splunk Enterprise (and other applications) can be installed without problems. 

Since SSLv3 has been disabled in our environment, the older versions do not deliver any data and cannot be used. 

As I can see in the MSI Installer log splunk has problems getting installed version: 
-------------------- 
Action start 16:49:22: GetPreviousSettings. 
GetPreviousSettings: Error 0x80004005: Failed to get lookup product code. 
------------------- 
Also tried to install as administrator from CMD-Line 

christopherr_sp
Splunk Employee
Splunk Employee

Consulted Development to see if any of the keys in the branch that you had exported were in a non-standard format (as this affects the ability for the Splunk installer to complete  the installation). 

When upgrading a Universal Forwarder or Splunk Enterprise if the hexadecimal value after HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products is not 32 hexadecimal characters the Splunk installer will report an error. It performs this check as part of the upgrade.

In the example below, there is a rogue character _.

Output: 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\C173E5AD3336A8D3394AF65D2BB0CCE6_] 

Use the Windows PowerShell to see if you have the issue:

Get-ChildItem HKLM:\SOFTWARE\Classes\Installer\Products | Where-Object { $_.Name -notmatch '\[0-9A-F]{32}$' } | Select-Object Name

Please take a backup of the key above (by exporting it to a file), then delete the branch within the registry.

If you have multiple hosts you can use the link below which can help automate the deletion process.

https://support.microsoft.com/en-gb/help/310516/how-to-add--modify--or-delete-registry-subkeys-and-v...

Ensure the existing Splunk installer is no longer running.

Development are working to make future releases of the installer work around those registry entries. 

This has been logged as a Bug:

SPL-128643 Splunk will not install if Windows' Installer's Products key contains invalid entries

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...