topic Re: splunk forwarder up-gradation using tar file on custom path in Getting Data In

splunk forwarder up-gradation using tar file on custom path

btshivanand — Wed, 24 Mar 2021 06:33:23 GMT

Hi All,

We are planning to upgrade splunk forwarders with ansible. We observed that our forwarders are running on custom path and we cannot run splunk as root user .we were checking tar options but i am not understanding how we extract the tar file on custom path.

can any one help with this?

Regards,Shivanand

Re: splunk forwarder up-gradation using tar file on custom path

scelikok — Wed, 24 Mar 2021 06:40:11 GMT

Hi @btshivanand,

tar normally extract files to the splunk folder inside current directory.

You have two options;

Using -C argument with tar, below will install into /custom_path/splunk

tar xvzf splunk_package_name.tgz -C /custom_path

Or you can run tar inside /custom_path

cd /custom_path tar xvzf splunk_package_name.tgz

Re: splunk forwarder up-gradation using tar file on custom path

btshivanand — Wed, 24 Mar 2021 06:50:33 GMT

Thanks for the quick reply.

We are trying to upgrade existing version.i understand that we can extract the tar file on custom path but when we extract by default it creates folder call splunkforwarder.our custom path is

/opt/product/Splunk/splunkforwarder_xx

if i extract the file in /opt/product/Splunk/ a new directory will get create call splunkforwarder. it is not upgrading my custom path "splunkforwarder_xx"

i hope you understood my concern

Re: splunk forwarder up-gradation using tar file on custom path

scelikok — Wed, 24 Mar 2021 07:04:27 GMT

Hi @btshivanand,

Now it is more clear.

So, you can extract tar to /tmp folder, then move it to opt/product/Splunk/splunkforwarder_xx path.

Splunk will make the upgrade when you restart the service.

Re: splunk forwarder up-gradation using tar file on custom path

btshivanand — Wed, 24 Mar 2021 07:16:06 GMT

Thanks.. just need some mor clarification.

if i extract under /tmp splunkforwarder dir will create. i need to move this directory to /opt/product/Splunk/splunkforwarder_xx.

cp -r splunkforwarder /opt/product/Splunk/splunkforwarder_xx

can you confirm my understanding correct?

We dont miss any configuration which is configured in input and output.conf

Regards, Shivanand

Re: splunk forwarder up-gradation using tar file on custom path

scelikok — Wed, 24 Mar 2021 07:58:32 GMT

Yes, correct. Your configuration files should be sitting on local folders. Since installation package has no local config it will not affect.

In any case it is better for you to test the procedure on a few test systems, after that put inside ansible.

Re: splunk forwarder up-gradation using tar file on custom path

btshivanand — Wed, 24 Mar 2021 08:01:32 GMT

Thanks a lot.. thats the plan we will test in one of the environment before putting into the ansible.

Re: splunk forwarder up-gradation using tar file on custom path

Vardhan — Wed, 24 Mar 2021 09:11:43 GMT

Hi @btshivanand ,

To resolve the issue first move your existing custom package from splunkforwarder_xxx to splunkforwarder

then unzip the new version on the existing folder. Once it is upgraded move your new version folder name to old name.