Splunk UF 9.1.3

[jspengler]

Reports from our Cyber dept that Splunk UF 9.1.3 is out.  The DL URL for 9 releases only show 9.1.2, can any one else confirm?

Thank you

[Spencer (Patch My PC)]

Hey There!

Thanks for reaching out! I have confirmed with our catalog team that Splunk UF 9.1.3 should be added in today's catalog update!

This should be available around 4pm est!

[jspengler]

Thank you!

[Spencer (Patch My PC)]

You're welcome! Have a wonderful day! 😊

[jspengler]

Just another FYI:  Having issues with the installation. Cyber downloaded and having issues as well.  1603 Error, they are reaching out to SPLUNK

[Spencer (Patch My PC)]

Thank you for the heads up! Are you deploying this through ConfigMgr or Intune and is this regarding the app or update package?

We'll want to take a look at the logs and try to repro the issue!  

[jspengler]

Config Mgr, ran manually and MSI alone (MSI logging) with no switches, same result.  I have both of those logs.  I need to republish with MSI Logging in PmPC options.

[jspengler]

looks like others may be having similar issues..

https://community.splunk.com/t5/Splunk-Enterprise/Splunk-Enterprise-9-1-3-Universal-Forwarder-can-t-be-updated/m-p/675236

[Spencer (Patch My PC)]

Thank you!
Looks like an issue with removing the previous version.

Could you please collect and send the following logs to [email protected]. We'll review them and see if we need to pull or modify the patch.

When troubleshooting ConfigMgr application installation errors on a client, we will need multiple client logs. Please include the following logs:

%WinDir%\CCM\Logs\AppDiscovery*.log
%WinDir%\CCM\Logs\AppEnforce*.log
%WinDir%\CCM\Logs\AppIntentEval*.log
%WinDir%\CCM\Logs\CAS*.log
%WinDir%\CCM\Logs\CIAgent.*log
%WinDir%\CCM\Logs\DataTransferService*.log
%WinDir%\CCM\Logs\PatchMyPC-ScriptRunner.log
This may be found in the %ProgramData%\PatchMyPC\ if the Install was initiated by the user from Software Center.
%WinDir%\CCM\Logs\PatchMyPC-SoftwareDetectionScript.log
This may be found in the %temp% of the user who clicked 'Install' in Software Center if it was an 'Available' deployment.
%WinDir%\CCM\Logs\StateMessage.log
%ProgramData%\PatchMyPC\PatchMyPC-UserNotification.log
%ProgramData%\PatchMyPC\UISettings\UINotificationSettings.xml

We'll also want to take a look at the msi install log.

[Spencer (Patch My PC)]

Thanks for sending over those logs! We're investigating this further and have had success with the 9.1.3 update by adding the following command line arg: USE_LOCAL_SYSTEM=1

I'm waiting on confirmation from our app devs to confirm if this is the best solution and will update you further! We may be adding this flag as a default if this is indeed the fix!

Please Stand By!

[Spencer (Patch My PC)]

Hello!

I wanted to confirm that our devs have approved the change to include USE_LOCAL_SYSTEM=1 as a default command line arg for 9.1.3.

This should be updated later today (4pm est or sooner) in our next catalog release! Please let me know if you have any questions or issues during testing! 😊