topic Splunk Upgrade from 7.3.0 to 9.x in Installation

Splunk Upgrade from 7.3.0 to 9.x

nachi — Sat, 24 Feb 2024 13:58:17 GMT

Hi,

We have a single splunk instance(Linux) hosted in AWS. The current version is Splunk entrprise 7.3.0 and we would like to upgrade to 9.x

Could someone please help us with the upgrade path and instructions.

Re: Splunk Upgrade from 7.3.0 to 9.x

gcusello — Sat, 24 Feb 2024 16:14:35 GMT

Hi @nachi,

upgrade from 7.3.0 to 9.x is a long path because they are a very different products and you have to change the python version,

so at first you have to migrate at 8.0.x or 8.1.x, following the steps at https://docs.splunk.com/Documentation/Splunk/8.2.1/Installation/HowtoupgradeSplunk

then at 8.2.x https://docs.splunk.com/Documentation/Splunk/9.1.0/Installation/HowtoupgradeSplunk

then at 9.0 or 9.1

and at least at 9.2 as described at https://docs.splunk.com/Documentation/Splunk/9.2.0/Installation/HowtoupgradeSplunk

Special attention must be used in App migration because python changed and the old apps could not be compatible with the new version; use the Upgrade readiness app (https://splunkbase.splunk.com/app/5483) to check your apps followinf the documentation at https://docs.splunk.com/Documentation/Splunk/latest/UpgradeReadiness/About?_gl=1*fwtqsv*_ga*MzU3MjIzOTU1LjE3MDA4MDg0NTc.*_ga_GS7YF8S63Y*MTcwODc5MDM2Ni40MTEuMS4xNzA4NzkxMTA1LjM3LjAuMA..*_ga_5EPM2P39FV*MTcwODc5MDMxNC40MjguMS4xNzA4NzkxMTA1LjAuMC4w&_ga=2.18236731.384474630.1707733577-357223955.1700808457

For the apps from Splunkbase, find the new versions compatible with the latest Splunk version.

Ciao.

Giuseppe

Re: Splunk Upgrade from 7.3.0 to 9.x

chenfan — Fri, 21 Feb 2025 07:26:08 GMT

Hi @gcusello
I am very confused, if we upgrade Splunk Enterprise from version 7.x.x to version 9.x.x, what impact will it have on the license? And will it affect the use of functions?

Re: Splunk Upgrade from 7.3.0 to 9.x

gcusello — Fri, 21 Feb 2025 08:00:27 GMT

Hi @chenfan ,

the impact on license is null because you pay license based on the logs that are daily indexed, so probably they will be the same.

About feature, you have many additional feature in the new Splunk version, you can read at the links I shared to see the new features and the removed features.

Put very much attention to the migration path and follow every step (even if it's very long!), because between 7 and 9 versions there were many structural changes (Pyton, mongodb, html, etc...).

Then you have also to upgrade all the apps, because some of them aren't compatible with the old app versions.

Then remember thet there's an orden in upgrading:

Cluster Manager,
Search Heads,
Indexers,
Other Splunk Servers (e.g. Deployment Server or Monitoring Console),
Heavy Forwarders
Universal Forwarders;

and this order must be maintained for each upgrade level (7->8 all the steps, 8->9 all the steps).

Last hint: plan all the steps in a document to be sure that you aren't forgotting any step.

As I said, it will be a very long job, and it could be a good idea, to engage a certified Splunk Architect in the design phase and eventually also in the execution phase.

Ciao.

Giuseppe

Re: Splunk Upgrade from 7.3.0 to 9.x

chenfan — Fri, 21 Feb 2025 08:32:41 GMT

Hi @gcusello，
Thankyou for your reply, it's very helpful for me. Can it be directly upgraded from 7.2.x to 9.2.x since it is a single node?

Re: Splunk Upgrade from 7.3.0 to 9.x

Cievo — Fri, 21 Feb 2025 08:42:00 GMT

Hello @chenfan

You cannot do direct upgrade from 7.2.x to 9.2.x. You have to go throught version levels as @gcusello mentioned in previous post.

Have a nice day,

Re: Splunk Upgrade from 7.3.0 to 9.x

gcusello — Fri, 21 Feb 2025 12:04:59 GMT

Hi @chenfan ,

no, as I said, you have to complete the steps in upgrade for all the nodes level by level:

at first, all the nodes from 7 to 8, than the others, you cannot upgrade node by node, but all the nodes of each level of the upgrade path.

Ciao.

Giuseppe

Re: Splunk Upgrade from 7.3.0 to 9.x

chenfan — Tue, 25 Feb 2025 03:12:21 GMT

Thanks!

Re: Splunk Upgrade from 7.3.0 to 9.x

gcusello — Tue, 25 Feb 2025 07:53:15 GMT

Hi @chenfan ,

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Splunk Upgrade from 7.3.0 to 9.x

chenfan — Wed, 05 Mar 2025 07:42:07 GMT

Hi @gcusello

Thank you for your reply！

Can I upgrade the platform from version 7.x.x to version 9.3.x and then uniformly upgrade the Apps/Add-ons to their latest versions? Will this have an impact on my system?

Re: Splunk Upgrade from 7.3.0 to 9.x

gcusello — Wed, 05 Mar 2025 07:50:02 GMT

Hi @chenfan ,

as I said, upgrade your platform using the upgrade path described in the documentation, don't skip any step!

Then you can upgrade your apps.

Ciao.

Giuseppe

Re: Splunk Upgrade from 7.3.0 to 9.x

isoutamo — Wed, 05 Mar 2025 10:31:10 GMT

This is depending from those apps. You must first check which are working in which splunk versions. It’s quite probable that you need to update those also step by step as it’s quite possible that same version doesn’t work on 7.x and 9.3. Also it’s possible that some apps don’t work anymore in 9.3. Also some may need OS level updates like OS version, Java or python updates etc.

Depending of your data and integrations you should even think and plan if it’s possible to setup totally new node up with fresh install and newest apps. That could be much easier way to do version update? Of course it probably needs that you could leave the old node up and running until its data have expired. Also you must transfer license to new server and add old as a license client for it.

Re: Splunk Upgrade from 7.3.0 to 9.x

chenfan — Tue, 25 Mar 2025 06:43:04 GMT

Hi, @gcusello
Considering various factors, we have decided to directly deploy a new Splunk Enterprise 9.3.X instance. Can we directly deploy the License file to the new instance?

Re: Splunk Upgrade from 7.3.0 to 9.x

gcusello — Tue, 25 Mar 2025 07:53:27 GMT

Hi @chenfan ,

Ok, there's no requirement on the license.

Anyway, the choose of install from scratch a new instance is a strange approach because you said to have a structured architecture with many servers and componente: in other words you want to start a new infrastructure,

I'm not sure that you save time creating from scratch the same infrastructure and copying all the apps and configurations, but it's your choose!

Ciao.

Giuseppe