topic Re: Mongo DB version in Splunk 8.2.5 in Splunk Enterprise

What version of Mongo DB version used in Splunk 8.2.5?

vengisa — Tue, 30 Aug 2022 20:46:11 GMT

We have a requirement to upgrade mongo DB to version 4.2 or later.

Can you please let me know what's the version of mongo DB used in Splunk 8.2.5.

If its not 4.2 or later, can you please let me know if mongo DB can be upgraded separately.

Will Splunk have any issues if Mongo DB upgrade is done.

Re: Mongo DB version in Splunk 8.2.5

richgalloway — Fri, 08 Apr 2022 17:19:51 GMT

Run $SPLUNK_HOME/bin/mongod --version to get the mongo DB version.

While it might be possible to upgrade the included version of mongo, I strongly advise against it. We don't know how customized the shipped version is so any upgrade you make may not work (or worse). Plus, Splunk Support is likely to disavow any such changes.

Consider going to https://ideas.splunk.com to make a case for an updated version of mongo DB.

Re: Mongo DB version in Splunk 8.2.5

amartin6 — Wed, 15 Jun 2022 17:58:37 GMT

I ran this on a vanilla 8.2.5 system:
[splunk~]$ splunk cmd mongod -version
db version v3.6.17-linux-splunk-v4
git version: 226949cc252af265483afbf859b446590b09b098
OpenSSL version: OpenSSL 1.0.2za-fips 24 Aug 2021
allocator: tcmalloc
modules: none
build environment:
distarch: x86_64
target_arch: x86_64
[splunk~]$

Re: What version of Mongo DB version used in Splunk 8.2.5

Dipesh — Tue, 30 Aug 2022 20:27:51 GMT

I had a similar finding for my splunk environment.

Looks like the latest version 9.0.1 has an update from Mongo3.6 to 4.2.

Here is the readme. http://docs.splunk.com/Documentation/Splunk/9.0.1/Installation/AboutupgradingREADTHISFIRST

- Dipesh

Re: What version of Mongo DB version used in Splunk 8.2.5?

amartin6 — Wed, 07 Sep 2022 14:40:35 GMT

We upgraded Splunk Enterprise version 9.0.0 from 8.2.5 and it did the upgrade of mongodb as part of the upgrade process, make sure you have enough disk space. You can also do the upgrade beforehand. If you are on version 3.6 it will do a hop to 4.0 before the final upgrade to 4.2. Check the version in use here: splunk show kvstore-status --verbose |grep serverVersion. It freed up tons of disk space for us after the upgrade, helps a lot if you have large kvstores.