Splunk Agent Install Issue - Error: The system cannot find the path specified.

[seenivasan]

Please help us to fix the below installation issue.

It seems the Splunk is trying to find some file in the system but unable to fetch/identify which is that file?

We tried to uninstall the previous setup, removed all reg_key as-well but still we are facing the same error.

We tried to run the previous version (v_7.x), getting the same error (the system cannot find the path specified)

C:\Windows\Temp\splunk>Splunkinstall.bat

C:\Windows\Temp\splunk>msiexec /i "splunkforwarder-9.1.2-xxx-x64-release.msi" AGREETOLICENSE=Yes /quiet

C:\Windows\Temp\splunk>net stop SplunkForwarder
The SplunkForwarder Service service is not started.

More help is available by typing NET HELPMSG 3521.

C:\Windows\Temp\splunk>copy deploymentclient.conf "c:\Program Files\splunkuniversalforwarder\etc\system\default\"
0 file(s) copied.

C:\Windows\Temp\splunk>net start SplunkForwarder
System error 3 has occurred.

The system cannot find the path specified.

[SinghK]

msiexec /i "splunkforwarder-9.1.2-xxx-x64-release.msi" AGREETOLICENSE=Yes /quiet

 add complete location of msi and deployementclient.conf in script.

[seenivasan]

I updated the exact path, the msi running & conf file is copied.
Still, we are getting the "System error 3 has occurred. The system cannot find the path specified"

C:\Windows\ccmcache\10>msiexec /i "C:\Windows\ccmcache\10\splunkforwarder-9.1.2-xxxx-x64-release.msi" AGREETOLICENSE=Yes /quiet /norestart

C:\Windows\ccmcache\10>net stop SplunkForwarder
The SplunkForwarder Service service is not started.

More help is available by typing NET HELPMSG 3521.

C:\Windows\ccmcache\10>copy deploymentclient.conf "c:\Program Files\splunkuniversalforwarder\etc\system\default\"
1 file(s) copied.

C:\Windows\ccmcache\10>net start SplunkForwarder
System error 3 has occurred.

The system cannot find the path specified.

[SinghK]

Use this script I have added below: open powershell ISE or powershell as administrator:

-----------------------------

The path C:\splunk_install needs to be created and put msi and other files in it 

open Powershell ISE as admin and then run the script

make sure the msi name is correct as per the msi you have up to versioning etc. it should be exact name.

this works fine for most of people has been tested.

-------------------------------

$srcAppPath = "C:\splunk_install\Splunk_TA_windows"
$appPath = "C:\Program Files\SplunkUniversalForwarder\etc\apps"

#installing forwarder
Invoke-Command -ScriptBlock { & cmd /c msiexec /i "C:\splunk_install\plunkforwarder-9.1.2-b6b9c8185839-x64-release.msi" AGREETOLICENSE=Yes /quiet}
Write-Host "Installation complete on $file" -ForegroundColor Green
Write-Host "Validating install by checking if service is running."
Get-Service -Name "SplunkForwarder" -ErrorAction SilentlyContinue
Write-Host "SplunkForwarder service is Running on $file" -ForegroundColor Green
Write-host "Copying necessary files for splunk ..."
write-host "stopping splunk service" -ForegroundColor Green
Stop-Service -Name SplunkForwarder
#copying addons
write-host "copying $srcAppPath"
Copy-Item -Recurse -Path $srcAppPath -Destination $appPath -Force
write-host "copy $srcAppPath complete"
write-host "copying $opappsrc"
Copy-Item -Recurse -Path $opappsrc -Destination $appPath -Force
write-host "copy $opappsrc conmplete"
Start-Service -Name SplunkForwarder
Write-Host "Validating by checking if service is running."
Get-Service -Name "SplunkForwarder" -ComputerName $file -ErrorAction SilentlyContinue
Write-Host "SplunkForwarder service is Running on $file" -ForegroundColor Green
write-host "Complete"

[seenivasan]

@ksing Thanks for sharing the script, it's running fine. But, still the Splunk Service is not running, please refer to the below output details.

Additionally, am thinking that the existing version was not uninstalled properly/corrupted. Is there proper way to clean existing Splunk entries from the device? Thanks.

Output:

Status Name DisplayName
------ ---- -----------
Stopped SplunkForwarder SplunkForwarder Service
SplunkForwarder service is Running on
Copying necessary files for splunk ...
stopping splunk service
copying C:\splunk_install
copy C:\splunk_install complete
copying
Copy-Item : Cannot bind argument to parameter 'Path' because it is null.
At line:18 char:26
+ Copy-Item -Recurse -Path $opappsrc -Destination $appPath -Force
+ ~~~~~~~~~
+ CategoryInfo : InvalidData: (:) [Copy-Item], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.CopyItemCommand

copy conmplete
Start-Service : Service 'SplunkForwarder Service (SplunkForwarder)' cannot be started due to the following error: Cannot start
service SplunkForwarder on computer '.'.
At line:20 char:1
+ Start-Service -Name SplunkForwarder
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommand
Exception
+ FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand

Validating by checking if service is running.
Get-Service : Cannot validate argument on parameter 'ComputerName'. The argument is null or empty. Provide an argument that is not
null or empty, and then try the command again.
At line:22 char:51
+ Get-Service -Name "SplunkForwarder" -ComputerName $file -ErrorAction ...
+ ~~~~~
+ CategoryInfo : InvalidData: (:) [Get-Service], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.GetServiceCommand

SplunkForwarder service is Running on
Complete

[PickleRick]

C:\Windows\Temp\splunk>copy deploymentclient.conf "c:\Program Files\splunkuniversalforwarder\etc\system\default\"
0 file(s) copied.

Well... that seems to indicate that either the source file doesn't exist or the source directory. It _might_ have something to do with your error.