topic Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM? in Getting Data In

How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

Suyalag — Tue, 06 Sep 2016 20:33:33 GMT

Hi,

I have set up a deployment server with a test app directory under etc/deployment-app along with a default inputs.conf. It also has a local folder and an app.conf auto generated file. Then I have a default serverclass.conf under etc/system/local. I also have a deployment-client.conf file set up on the forwarders. The clients are connecting to the server fine and also saying that the clients are deployed, but it is not updating the forwarder from version 6.2 to 6.4. Am I missing a step that is preventing it from updating the forwarder?

Also, I have the rmp file in the etc/deployment-app/testapp folder.
Please let me know what I am doing wrong.

Thank you for your help.
Gary

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

somesoni2 — Tue, 06 Sep 2016 20:47:34 GMT

AFAIK, you can't upgrade Splunk version on deployment client using deployment server. You would have to use regular methods that you use in your Company to upgrade those (manually on each server, OR using some remote script execution method like upush OR puppet etc). http://docs.splunk.com/Documentation/Splunk/6.4.3/Updating/Configuredeploymentclients#Upgrade_a_deployment_client

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

Suyalag — Tue, 06 Sep 2016 20:50:48 GMT

not upgrading the splunk enterprise version just splunk forwarder from a splunk enterprise instance. Can i not do that either?

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

somesoni2 — Tue, 06 Sep 2016 21:18:12 GMT

Product version, whether it's a Splunk Enterprise OR Splunk Universal Forwarder, upgrade is not possible through Deployment server.

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

esix_splunk — Wed, 07 Sep 2016 02:05:07 GMT

As somesoni2 points out, you cannot use the Deployment Server to upgrade an actual Splunk instance { Enterprise or UF. } The deployment server is only used for managing installled apps within the client, not the actual client.

With that in mind, you need to rely on automation or manual processes to upgrade the actual client.

On a side note, when you upgrade, your deployment server configuration will be preserved and not deleted, so you can do in place upgrades and not have to worry about the clients loosing the deployment server configurations.

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

Michael — Thu, 01 Dec 2016 19:27:56 GMT

ha! Great, I read this now. That was a large part of our decision to go with a deployment server architecture....

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

mikehodges01 — Mon, 13 Mar 2017 17:55:55 GMT

I'm doing exactly this. Write a script and refer to it in an inputs.conf.

I have an app folder "WinUpdate", then I have "default" and "bin". In \default is an inputs.conf that says [script://..\bin\installer.bat]. Under \bin I place the forwarder MSI and an install script that checks the currently installed version of Splunk against a copy of splunk.version I put in \bin as well. If they're different, the script executes and upgrades the UFs. Get a little creative! Splunk can do almost anything you need it to do. This method works perfectly for me.

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

mhsears418 — Thu, 30 Mar 2017 16:55:18 GMT

awesome MikeH. You mention an install script that checks if versions are different. could you post that or get example to me?

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

mikehodges01 — Thu, 30 Mar 2017 17:27:26 GMT

I used to get the output of splunk.exe version and put it in a file that I distributed with the app, then issue that same command in my script on the target machine and dump the output to a temp file, and then use Windows fc to compare the files. If they're different, run the upgrade. Now I'm upgrading to a Powershell script that uses a regex match to pull the version from etc\splunk.version on the target machine and the MSI I include in the app to see if they're the same.

[regex]$regex = "\d\.\d\.\d"

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

mhsears418 — Thu, 30 Mar 2017 17:30:01 GMT

ok very cool info...appreciate it.

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

ppeterson — Thu, 30 Mar 2017 19:45:19 GMT

I'd love to see the powershell script you have or a partial as i"ll be needing to do the same.

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

mhsears418 — Fri, 31 Mar 2017 17:03:58 GMT

Mike, so is your hierarchy like this? C:\ProgramFiles\Splunk\etc\apps\WinUpdate\Default
C:\ProgramFiles\Splunk\etc\apps\WinUpdate\Default

Or C:\ProgramFiles\Splunk\etc\apps\WinUpdate\
C:\ProgramFiles\Splunk\etc\apps\Default
C:\ProgramFiles\Splunk\etc\apps\Bin

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

chrismewett — Thu, 15 Jun 2017 01:06:03 GMT

There's now a splunk blog post on doing exactly this for linux forwarders (to match @mikehodges01 approach for windows, viz:
https://www.splunk.com/blog/2017/04/28/upgrading-linux-forwarders-using-the-deployment-server.html

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

chrismewett — Thu, 15 Jun 2017 01:07:01 GMT

There have been developments over the last few months - check out the other comments on the thread.

Re: How to upgrade Splunk forwarders from a deployment server installed on a separate VM?

cboillot — Tue, 10 Jul 2018 20:37:13 GMT

@mikehodges01 could you share the Script?