topic Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2 in Splunk Enterprise

Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

splunkuser109 — Mon, 22 Mar 2021 17:26:35 GMT

Is there any documentation on safely upgrading splunk machines (master, searchhead, indexers) on splunk version 8.0.2 from RHEL 7 to RHEL 8 ?

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

richgalloway — Sat, 20 Mar 2021 12:38:11 GMT

How to upgrade your OS is a better question for the Red Hat community than the Splunk community. Splunk does not offer guidance on how to upgrade the OS it runs on.

You will, of course, need to stop each Splunk instance so it's OS can be changed. The order is not significant since you are not changing Splunk versions. Just be sure to do one instance at a time and to put your indexer cluster (if you have one) into maintenance mode first.

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

splunkuser109 — Sun, 21 Mar 2021 23:35:20 GMT

Thanks for the input! How can we put the index cluster into maintenance mode? Do we just run the command from this document on the master node? https://docs.splunk.com/Documentation/Splunk/8.1.2/Indexer/Usemaintenancemode

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

isoutamo — Mon, 22 Mar 2021 07:31:40 GMT

Yes those are correct commands to do it.

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

splunkuser109 — Mon, 22 Mar 2021 17:12:20 GMT

Thank you! What are some splunk commands I can use to verify that everything is working properly? I have checked the splunk service status on all the machines, the search function in the web UI, and ran the splunk show cluster-bundle-status to check the status of the indexer cluter.

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

isoutamo — Mon, 22 Mar 2021 21:01:37 GMT

MC dashboards are a good starting point to check after update. Also do those apply xxx and rolling-restarts.
You should have some standard metrics which shows the normal situation which you should use to validate current situation.

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

mdtoro — Wed, 04 Jan 2023 20:48:09 GMT

Splunk isn't dependent on library versions of the OS? Or, build any static libraries based on the OS?

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

richgalloway — Wed, 04 Jan 2023 21:20:50 GMT

Splunk is dependent only on the kernel version.

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

mdtoro — Wed, 04 Jan 2023 22:12:06 GMT

Kernel and Posix threads (libpthread?)

Not sure how much the pthread library version matters.

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

mdtoro — Thu, 05 Jan 2023 16:46:31 GMT

Any issues with the version of glibc?

Re: Upgrade from RHEL 7 to RHEL 8 on version 8.0.2

richgalloway — Thu, 05 Jan 2023 17:48:14 GMT

Splunk's system requirements documentation (https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements#System_requirements_for_use_of_Splunk_Enterprise_on-premises) mention OS kernels and a few caveats, but nothing about specific libraries. From that I conclude there are no dependencies on libraries.