topic Re: How to upgrade Apps (Palo Alto) on a Heavy Forwarder Cluster setup? in Getting Data In

How to upgrade Apps (Palo Alto) on a Heavy Forwarder Cluster setup?

splk — Tue, 05 Jul 2016 06:05:15 GMT

Hello community,

I just take over a cluster (which is not in full productive mode yet) and i want to update all settings / apps before go live.
The Palo Alto App for example is on 4.x, available already is 5.x.

The cluster consists of Heavy Forwarders, Indexer Cluster and Search Heads (incl. Cluster Master and Management Server).
I can not find any documentation which tells me how to upgrade apps on such an setup.

So how to start, and in which order?
1. Create a new deplyoment app (deplyoment server) for the HF
2. Create a new shccluster app for the Search Heads
3. Create a new master app for the indexer cluster?

But what about the already installed Palo Alto App 4.x and the configuration files (local/transforms.conf...).
Do I need to uninstall the App first? Migrate the conf files by hand? Or is Splunk aware of the ugprade?

Thanks for your help.

Re: How to upgrade Apps (Palo Alto) on a Heavy Forwarder Cluster setup?

splk — Tue, 05 Jul 2016 11:47:37 GMT

Looks like the documentation: http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/PropagateSHCconfigurationchanges points in some direction: To update an app on the cluster members, put the updated version in the configuration bundle.

But what does this mean technically? Untar the App and overwrite the existing one? What to do with the system/local/* files?

Re: How to upgrade Apps (Palo Alto) on a Heavy Forwarder Cluster setup?

splk — Thu, 01 Sep 2016 05:34:59 GMT

Resolved:

Simple extract the new App into the existing app directory and overwrite all files (some backup would be helpful), local/ should be untouched. Follow the upgrade instructions from the app itself.