topic Upgrade Splunk on Linux in Installation

Upgrade Splunk on Linux

nikhilagrawal — Mon, 28 Sep 2020 15:28:04 GMT

We are running Splunk 5.0.3, build 162460 on our UAT environment. I tried upgrading to latest version 6. I am following the steps described in the document.
1. Stop current Splunk instance.
2. Copy splunk-6.0-182037-Linux-x86_64.gz same directory (opt/splunk/).
3. run: tar xvfz splunk-6.0-182037-Linux-x86_64.gz under (opt/splunk/). Which created another directory "Splunk". so now there is /opt/Splunk/Splunk.
4. Then tried (mv * ../ )under opt/splunk/splunk to move all dir from new splunk instance to upper level. I thought this will overwrite the existing splunk files. But its returning error "Can't overwrite etc, Bin and some other directories.
Can someone please suggest what is wrong here?

Thanks
Nik

Re: Upgrade Splunk on Linux

bbingham — Thu, 12 Dec 2013 12:35:04 GMT

if you're going to try extracting from the already existing directory (/opt/splunk) you'll actually want to use this command:

tar -xzvf splunk-6.0-182037-Linux-x86_64.gz  --strip-components=1

This will tell the tar command to strip off the "splunk" dir during extraction and only extract the contents.

Re: Upgrade Splunk on Linux

nikhilagrawal — Thu, 12 Dec 2013 12:54:22 GMT

slight change:
tar -xzvf splunk-6.0-182037-Linux-x86_64.gz --strip-path=1
it worked with the change.
Thanks

Re: Upgrade Splunk on Linux

jamesarmitage — Tue, 10 Nov 2015 19:47:17 GMT

The --strip-components flag is appropriate for CentOS / RHEL tar. Check the manpage for your distro to determine the proper syntax.

bbingham, thank you. This tip saved me a fair bit of frustration upgrading two instances installed on the same server.