Installing Splunk on endpoints - status running but its not

John, you may try this:
wait “{pathname of system folder & “\msiexec.exe”}” /i “{(pathname of client folder of current site) & “__Download\splunkforwarder-9.3.0-51ccf43db5bd-x64-release.msi”}” AGREETOLICENSE=Yes /qn /norestart

I didn’t read the whole thread, but wanted to offer up something we do with apps like Splunk. While not required, and we have no data it truly helps (or a percentage) but we stop services first (if upgrade or repair) and then attempt to start again after install/upgrade.

// Stop service before install
if {(exists running service “SplunkForwarder”)}
WAITHIDDEN CMD.EXE /C NET STOP “SplunkForwarder”
endif

// Start service and set to auto
if {(not exists running service “SplunkForwarder”)}
waithidden sc config “SplunkForwarder” start=auto
WAITHIDDEN CMD.EXE /C NET START “SplunkForwarder”
endif

1 Like

Back at this again. Jason would it help if I made the msi avaialble on one drive for you to access?