Here is our BigFIx Action Script to update Splunk on RHEL. Using the action script will help narrow down which part is failing when looking at the Show Action Info.
----- Begin
//Install Splunk Forwarder on RHEL
//Grab installer and configuration files
prefetch splunkforwarder-9.1.4-a414fc70250e.x86_64.rpm sha1:99294ccac7199d75788f46562f1e0f13a227cb73 size:47609600 https://hostname/splunk/splunkforwarder-9.1.4-a414fc70250e.x86_64.rpm
// Good housekeeping
delete “/tmp/splunkforwarder-9.1.4-a414fc70250e.x86_64.rpm”
// Move the downloaded RPM to TMP directory
move “__Download/splunkforwarder-9.1.4-a414fc70250e.x86_64.rpm” “/tmp/splunkforwarder-9.1.4-a414fc70250e.x86_64.rpm”
// Update RPM permissions
wait sudo su - root -c “chmod 744 /tmp/splunkforwarder-9.1.4-a414fc70250e.x86_64.rpm”
parameter “__ExitCode01” = “{if exist exit code of action then exit code of action as string else “999”}”
if {parameter “__ExitCode01” != “0”}
exit {parameter “__ExitCode01”}
endif
// Execute RPM install command for Splunk agent
wait sudo su - root -c “rpm -U /tmp/splunkforwarder-9.1.4-a414fc70250e.x86_64.rpm”
parameter “__ExitCode02” = “{if exist exit code of action then exit code of action as string else “998”}”
if {parameter “__ExitCode02” != “0”}
exit {parameter “__ExitCode02”}
endif
// Run as splunk user
wait sudo su - root -c “/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes”
// Good housekeeping
delete “/tmp/splunkforwarder-9.1.4-a414fc70250e.x86_64.rpm”