Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Tuesday, August 15, 2017 7:33 AM
Hi everyone,
I have developed an installation and uninstall application with supersedence for SPLUNK with the following MSI command line:
Install
msiexec.exe /i splunkforwarder-6.3.3-x64-release.msi RECEIVING_INDEXER="IndexServ:9997" DEPLOYMENT_SERVER="DPServ:8089" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /q
Uninstall
msiexec /x {6909E33C-54C7-4380-9790-93E834B78BAF} /q
The uninstall works fine, only when we reinstall we get a 1603 event. Splunk forwarder already installed.
When i look at the Server where it was uninstalled it's uninstalled fine. No programs, no directory, no service.
But when i look at the registry: HKEY_CLASSES_ROOT\Installer\Products & Features i see this key
\C33E90967C4508347909398E437BB8FA
When i delete it, i can do a clean install.
But it's for 800 clients, so this is not a good solution even with a script. Am i doing something wrong in the MSI command or are their other solutions for this problem?
Kind regards,
André
All replies (13)
Wednesday, August 16, 2017 1:18 PM ✅Answered
But like i sad it's fully uninstalled only the two installer keys are in the registry
it seems to me, that this is in fact the main problem...
an uninstall *should* not leave *any* registry keys for that uninstalled product remaining at all.
so, if the installation routine inside the MSI is performing is_already_installed detection, and those registry keys are detected as exists, the installation routine would return "product is already installed", which would be a false/incorrect result.
and, such faulty detection logic/routine, is the fault of the splunk software developers, and neither ConfigMgr nor msiexec is responsible for such defective logic - the splunk software developer would seem to be at fault here.
ConfigMgr/Windows/MSI, has no 'special magic ability' to overcome such defective logic by the software developer.
the verbose MSI log of the installation or uninstallation activity, may reveal why the failure is occurring, and that may help to understand your options for a workaround, but really, the splunk installer package seems lacking, or defective.
Don [doesn't work for MSFT, and they're probably glad about that ;]
Wednesday, August 16, 2017 2:56 PM ✅Answered
Because of the WinEventLOG statement i get the full error in my eventlog. Which is what i have mentioned:
Product: UniversalForwarder -- This version of UniversalForwarder has already been installed on this computer.
Check the logfile of the actual installation, the one you specified in the command line, it should give you more details on which MSI package (GUID) is installed already and is interfering with your new installation.
Tuesday, August 15, 2017 9:23 AM
You have to examinen the msi log. 1603 is a generic msi error.
Torsten Meringer | http://www.mssccmfaq.de
Tuesday, August 15, 2017 11:57 AM
after uninstall, did you reboot? is the reverse-nibble-GUID at \Installer\ removed by reboot?
Don [doesn't work for MSFT, and they're probably glad about that ;]
Tuesday, August 15, 2017 12:46 PM
Because of the MSI command i use i get the error in the eventlog. And it gives an error that the application is already installed.
Tuesday, August 15, 2017 1:54 PM
Yes, i have done a restart and still the installation fails.
Tuesday, August 15, 2017 2:01 PM
Yes, i have done a restart and still the installation fails.
Try running the installer: msiexec.exe /i splunkforwarder-6.3.3-x64-release.msi RECEIVING_INDEXER="IndexServ:9997" DEPLOYMENT_SERVER="DPServ:8089" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /q /l*v C:\Windows\Temp\SplunkForwarder.log
And examine the SplunkForwarder.log for clues why the 1603 exit code.
Tuesday, August 15, 2017 9:42 PM
not a new issue, it seems..
https://www.google.com.au/search?q=site%3Aanswers.splunk.com+splunk+forwarder+install+error+1603
but because 1603 is a very generic error resultcode, it can have any number of different root causes, the suggested steps of creating verbose MSI log and analysing that log, may help to understand cause in your case.
But if the product installer is at issue, best to raise the topic with Splunk support team.
Don [doesn't work for MSFT, and they're probably glad about that ;]
Wednesday, August 16, 2017 8:39 AM
Because of the WinEventLOG statement i get the full error in my eventlog. Which is what i have mentioned:
Product: UniversalForwarder -- This version of UniversalForwarder has already been installed on this computer.
Wednesday, August 16, 2017 8:40 AM
But like i sad it's fully uninstalled only the two installer keys are in the registry
Wednesday, August 16, 2017 8:42 AM
Hi Don,
I've registered for the SPLUNK user group. Getting support is not that easy. Even if you pay a lot ;-). Hope they give a solution.
I hoped there where other solutions like a force install in the MSI or with SCCM.
Kind regards,
André
Friday, August 18, 2017 5:50 AM
Thanks guys i did looked at the logging and it looks like a SPLUNK deployment issue. It leaves the Productcode after deinstallation.
So trigger a new deinstallation doesn't work.
Friday, August 18, 2017 5:50 AM
Thanks guys i did looked at the logging and it looks like a SPLUNK deployment issue. It leaves the Productcode after deinstallation.
So trigger a new deinstallation doesn't work.