topic Re: Upgrade Multiple Splunk Instances on the Same VM in Getting Data In

Upgrade Multiple Splunk Instances on the Same VM

daniaabujuma — Wed, 31 May 2023 06:26:35 GMT

Hello,

I am running multiple Splunk instances on the same machine, located in /opt as follows:

/opt/splunk1

/opt/splunk2

/opt/splunk3 ... etc

I need to upgrade Splunk Enterprise to a newer version, I tried using the following RPM command:

sudo rpm -Uvh --relocate=/opt/splunk=/opt/splunk1 splunk.rpm

But I received the following error message:

path /opt/splunk in package splunk is not relocatable

I tried using a .tgz file instead, but it's also not working.

sudo tar -xzf splunk.tgz -C /opt/splunk1

Can anyone recommend a way to upgrade Splunk on all my instances?

Re: Upgrade Multiple Splunk Instances on the Same VM

isoutamo — Wed, 31 May 2023 06:37:35 GMT

as you probably know you shouldn't run several instances on same node! You could do this only on your lab environment in all other cases you should use separate VMs for those .

When you have several installation on same node you cannot install those via package manger like rpm. Basically you could have one instance like /opt/splunk which have installed and updated by rpm.

Probably easiest way is to install a new version into /opt/splunk and then just use e.g. rsync to copy a new versions to other directories one by one. Another option (if you have gnu tar) is try

cd /opt/splunk1 && tar --strip-components 1 -xvf <path>/splunk-xyx.tgz

r. Ismo

Re: Upgrade Multiple Splunk Instances on the Same VM

daniaabujuma — Wed, 31 May 2023 06:54:15 GMT

Hi @isoutamo

Thank you for your reply!

I tried your recommendation but unfortunately it didn't work. Do you have any other recommendation that might work?

Thank you.

Re: Upgrade Multiple Splunk Instances on the Same VM

isoutamo — Wed, 31 May 2023 06:59:10 GMT

One hack could be

mkdir -p /tmp/splunk
cd /tmp/splunk
tar xvzf <path to downloaded>/splunk-xyx.tgz
cd splunk
tar cvzf ../splunk-relocated.tgz ./*

That will repackage splunk version without splunk/ directory prefix.

Now just go to /opt/splunk1 etc. one by one and use /tmp/splunk/splunk-relocated.tgz package as source. Note you must be in /opt/splunk1 not in /opt directory when you are extracting that package!

Re: Upgrade Multiple Splunk Instances on the Same VM

daniaabujuma — Wed, 31 May 2023 07:25:44 GMT

Thank you @isoutamo this worked perfectly!