topic Re: Splunk Upgrade in Splunk Enterprise

Splunk Upgrade

maheshnc — Sat, 01 Nov 2025 16:26:08 GMT

I am new as splunk administrator here in the company. we are using Splunk enterprise and the current version is 9.2.4, and as per splunk document this version is supported until Jan 31 2026, can somebody guide me on version upgrade, and also which version should we upgrade? Also, I am not sure about the risk in upgrading the version, please provide your suggestions.

Re: Splunk Upgrade

richgalloway — Sat, 01 Nov 2025 17:21:05 GMT

For instructions on how to upgrade Splunk Enterprise, read the fine manual at https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/9.4/upgrade-or-migrate-splunk-enterprise/how-to-upgrade-splunk-enterprise

The choice of which version to install is yours. I recommend a later version of 9.4.x. This will help you prepare for Splunk 10 without the risk of the same.

IMO, the risk of upgrading usually is less than that of not upgrading and being on an unsupported version. Splunk 10 is an exception since it contains many breaking changes for which careful planning is recommended.

Re: Splunk Upgrade

maheshnc — Sun, 02 Nov 2025 08:25:32 GMT

what should be sequence for upgrading? could you suggest the precautions to be taken which may overcome the risk as I am doing this upgrade for the first time.

Re: Splunk Upgrade

thahir — Sun, 02 Nov 2025 08:36:26 GMT

@maheshnc

Please refer this url https://community.splunk.com/t5/Installation/What-s-the-order-of-operations-for-upgrading-Splunk-Enterprise/m-p/408003

Re: Splunk Upgrade

maheshnc — Sun, 02 Nov 2025 09:02:17 GMT

Could you let me know about the version compatibility for various instances, I mean can we indexers, search heads and Heavy forwarders with different versions or should they have the same version?

Re: Splunk Upgrade

thahir — Sun, 02 Nov 2025 09:36:08 GMT

@maheshnc

Yes, ideally all your Splunk components—indexers, search heads, deployers, cluster managers, and heavy forwarders—should run the same version and its recommended from Splunk.

Refer the below URL for Compatibility matrix: https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-products-version-compatibility/splunk-products-version-compatibility-matrix

For forwarders (both Universal and Heavy), Splunk officially supports a compatibility window where forwarders can be up to two major versions older than your indexers. You can find Splunk’s detailed compatibility guidelines at the official documentation link you referenced, which covers all combinations and exceptional scenarios.

refer the below url: https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-products-version-compatibility/compatibility-between-forwarders-and-splunk-enterprise-indexers

High Level upgrade plan

-> Pre check

Apps/TA compatibility with the new version which you going to upgrade

Backup the Splunk etc folder, certs and KV store

-> follow the upgrade sequence order

-> Post upgrade: verify the cluster health and review the splunkd logs, if you have DMC in your infra go through the console and do the health check

Re: Splunk Upgrade

maheshnc — Mon, 03 Nov 2025 06:24:23 GMT

Could you please walk me through the backups needs to be taken/mandatory

Re: Splunk Upgrade

thahir — Mon, 03 Nov 2025 07:46:41 GMT

@maheshnc , Backup the entire $SPLUNK_HOME/etc/ directory. basically it will cover all of your config related files.

Re: Splunk Upgrade

PickleRick — Mon, 03 Nov 2025 11:11:50 GMT

Ideally, in a supported environment, all "main" components should be in the same version. You can get away with HFs running older versions (which is sometimes required if you have legacy systems for which you are using some legacy apps).

The order of upgrade can be deduced from the Installation Manual (and is charted in the post referenced somewhere else in this thread) but it can get tricky if your components have multiple roles.

Don't get me wrong but if you don't know nothing about upgrading Splunk and don't even know how to make a backup copy, maybe it's time to engage your local friendly Splunk Partner for this one and in the meanwhile set up a lab environment and train there before going all-in into the prod.

Re: Splunk Upgrade

isoutamo — Mon, 03 Nov 2025 17:53:21 GMT

Additional to other instructions, here is Splunk's best practice documentation for upgrade https://lantern.splunk.com/Manage_Performance_and_Health/Upgrading_the_Splunk_platform