How do we upgrade all forwarders on Windows and Linux in our environment from Splunk 5.0.4 to 6.x?

jkponnuri — Wed, 30 Dec 2015 03:27:48 GMT

I am currently using Splunk 5.0.4 and trying to upgrade to Splunk 6.x along with all forwarders. How can I upgrade all Splunk forwarders on Windows and Linux servers in one shot? We have roughly 1000 forwarders. Any suggestions? Can I upgrade forwarders first to version 6 and later upgrade Splunk Enterprise to 6? Is that OK?

Thanks in advance...

Re: How do we upgrade all forwarders on Windows and Linux in our environment from Splunk 5.0.4 to 6.x?

jkat54 — Wed, 30 Dec 2015 14:21:08 GMT

As for how to upgrade them... You'll need to write scripts that take into account the architecture of each os, among other variables.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/UpgradetheWindowsforwarder
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/UpgradetheNixforwarder
http://docs.splunk.com/Documentation/Splunk/6.1/installation/HowtoupgradeSplunk

For windows, i've used winrm and powershell remoting. For linux I've used everything from bash scripts to python.

As for compatabillity between versions:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Compatibilitybetweenforwardersandindexers

topic How do we upgrade all forwarders on Windows and Linux in our environment from Splunk 5.0.4 to 6.x? in Getting Data In

How do we upgrade all forwarders on Windows and Linux in our environment from Splunk 5.0.4 to 6.x?

Re: How do we upgrade all forwarders on Windows and Linux in our environment from Splunk 5.0.4 to 6.x?